Abbie Carlson

As a Product Marketing Manager, I'm responsible for communicating the value of Identity for consumer apps as well as focusing on the developer experience. I'm forever curious about how Identity plays a role in our everyday lives as consumers and how a great Customer Identity solution can make or break a business through patron loyalty and retention. 

Outside of work can catch me watching Seattle sports, going to as many concerts as I can or listening to true crime podcasts.

Senior Product Marketing Manager

Introducing updated self-service plans and pricing that scale with your company

<div class="alert alert-info alert-icon">
  <i class="icon-budicon-487"></i>
  <strong>UPDATE:</strong><br> 
  This information was modified on December 11th, 2023. The new plans and feature offerings are now universally available for everyone.<br> 
</div>

We're excited to share with you our updated and revamped plan offerings for Auth0, which powers Okta Customer Identity Cloud.

Effective November 1st, 2023 we launched changes to our plan offerings and pricing structure. Changes listed below:

* **Our free plan now supports up to 7,500 MAUs vs the previous 7,000.**
    * More than 65,000 active tenants enjoy this plan today.
    * Our always-free plan continues to offer social login, DB connection for securely storing identity information, branded login, extensibility and security capabilities (brute force and suspicious IP throttling), and support for 5 regions (US, UK, EU, JP, AUS). 
    * We also recently added [passkeys support](https://auth0.com/blog/activate-passkeys-let-users-log-in-without-password/) to the free plan.
* Our pricing structure has been updated to more predictably scale as you grow:
    * B2C Essentials pricing now starts at $35/Mo for 500 Monthly Active Users (MAUs)
    * B2B Essentials pricing now starts at $150/Mo for 500 MAUs
    * You can now purchase 20,000 MAUs on B2C Essentials with your credit card.
* [Auth0 Teams](https://auth0.com/docs/get-started/tenant-settings/auth0-teams#access-the-teams-dashboard), a new feature that aggregates usage across all tenants for seamless oversight that includes updated tenant limits with the ability to consolidate tenants.
* The below capabilities that can be added to your plan through our “[Let’s Chat](https://auth0.com/contact-us?place=header&type=button&text=contact%20sales)” form. You will need to move to a new plan with a yearly spend of $10,000 or more to take advantage of these options but we plan to include these add-ons via our self service plans (with a lower minimum) in the first half of 2024:
    * New multi-factor authentication (MFA) add-ons, expanding access to MFA capabilities that were previously only available to enterprise customers.
    * Increased enterprise connection limits on the B2B Professional Plan.
    * We have increased our maximum MAU tier limit on our self-service plans.

> It’s important to note that we are not making changes to any existing plans as a result of this update. However, if you make changes to your subscription, the new plan and pricing structure will be applied.

## Pricing & Payment Updates

We last updated our Essentials and Professional plan pricing in May of 2021. With the above changes the following pricing updates became effective on November 1st, 2023. **Keep in mind, this only applies to new sign ups and any subscription changes.**

* B2C Essentials pricing will now start at $35/Mo for 500 MAU, up from $23/mo for 1,000 MAU. 
* B2B Essentials prices will now start at $150/Mo up from $130/Mo for 500 MAU
* B2C Professional prices will stay the same, starting at $240/Mo for 1,000 MAU
* B2B Professional will now only be available by invoice, via our sales team, rather than credit card. 

The price adjustment on B2C Essentials creates increased transparency and price predictability as your MAUs scale on our platform, reducing the risk of customers who grow from B2C Essentials into higher plans being shocked by a price change. While the scaling rate of B2C Essentials is increasing, we’re committed to enabling customers to stay on their chosen plan for longer by making it possible to remain on a self-service plan when surpassing the previous MAU limit of 10,000.

In addition to the above plans, check out the [Auth0 for Startups program](https://auth0.com/startups), our [Auth0 for Non-Profits](https://auth0.com/nonprofits) offers, as well as our always-free plan.

### Payment options

With the above changes, we are committed and will continue to support customers that want to pay us monthly through their credit cards on plan tiers that previously supported this functionality. We will now also allow customers with a yearly spend over $10,000 to contact our sales team to purchase an annual contract paid via invoice. 

Keep in mind, any new tenants created will be subject to the new pricing structure outlined above.

![Payment options](https://images.ctfassets.net/23aumh6u8s0i/7trs7tiGY0Ea5rQ2GmU0D3/952fb21eac9f2306c58d1a3e1bb4a14a/pricing-02.jpg)

`*` Can only be purchased by contacting our Sales team directly or via the ["Contact Sales"](https://auth0.com/contact-us?place=header&type=button&text=contact%20sales) form. Please note you will need to move to a new plan with a yearly spend of $10,000 or more to take advantage of these options but we plan to include these add-ons via our self service plans (with a lower minimum) in the first half of 2024.<br> 
`**` Previously, each tenant was a separate subscription, so only one tenant of any type was allowed per plan.

## Introducing Auth0 Teams:

We understand at times it’s difficult to manage resource access, keep track of and juggle multiple tenants. Auth0 Teams aggregates usage across all tenants for seamless oversight. The addition of this feature will enable the management of administrators and multiple tenants from a single, centralized location.

### Increased tenant limits

Tenant limits are being increased as part of this update.

These new limits will be displayed on both our [pricing page](https://auth0.com/pricing) and in your tenant’s [subscription settings](https://manage.auth0.com/#/tenant/billing/subscription). 

![Increased tenant limits](https://images.ctfassets.net/23aumh6u8s0i/6c62XnCJPnWmP72v55PIlY/f33f1ad5bf8c52375a25c92f74bd73db/pricing-01.jpg)

**With the launch of Auth0 Teams, you can now link existing tenants together under one account. It’s important to note that:**

* The owner of a team and/or the admin on the tenant are the only individuals that can group tenants.
* Tenants cannot be unlinked without the assistance of Auth0 Customer Support. If you linked a tenant and need to unlink it, please contact Support by submitting a ticket in the [Auth0 Support Center.](https://support.auth0.com/)

> Keep in mind, if you choose to stay on your current plan, you will be allowed a single tenant.

### How is this different than current Auth0 offerings?

As a part of this pricing change, customers will have the opportunity to link multiple tenants to the same subscription. Usage will be aggregated across tenants and will be billed at the subscription level. This allows customers with development and staging tenants to have access to the same features within said tenants, without having to purchase additional subscriptions. Along with these changes, we’re also introducing official tenant limits that align with the positioning of our various offerings. 

### Steps on how to migrate to Auth0 Teams

Information about this process can be [found here](https://auth0.com/docs/get-started/tenant-settings/auth0-teams). If you want to migrate to Auth0 Teams, you must upgrade your plan in your tenant’s[ subscription settings](https://manage.auth0.com/#/tenant/billing/subscription) to have Teams automatically enabled for you.

## Additional Feature Offerings:

### Enterprise MFA Add-ons:

Multi-factor authentication ([MFA](https://auth0.com/docs/secure/multi-factor-authentication)) can block 99.9% of account hacking attacks. So, without being too obvious, implementing MFA within your Identity solution is pretty important. It’s imperative to prevent credential based attacks, and we want to make this easier for our customers to have access to this security feature. And so we’re introducing** Enterprise MFA Lite.**

Auth0 now allows you to use additional MFA capabilities that were previously only available to enterprise customers. Enterprise MFA Lite allows you to add any MFA factor to [Professional Plans](https://auth0.com/pricing) for an additional fee. This includes the support of [SMS](https://auth0.com/docs/secure/multi-factor-authentication/multi-factor-authentication-factors/configure-sms-voice-notifications-mfa) and push & voice notifications (SMS charges for MFA are charged separately by carriers supported by Auth0). Under Enterprise MFA Lite, subscriptions will be limited to one MFA factor on the subscription. However, this enhancement will give broader access to additional MFA protocols to support a wider range of use cases. 

### Enterprise Connection Limits:

**[Enterprise Connection](https://auth0.com/docs/authenticate/enterprise-connections)** limits are increasing from three connections to five connections on the B2B Professional Plan. This will allow for more of our SaaS customers to scale better. As a reminder, there is no limit on Okta Enterprise Connections for customers on all of our B2B plans. 

### Monthly Active Users (MAU) Tiers:

We are introducing [Essential](https://auth0.com/pricing) and [Professional](https://auth0.com/pricing) MAU tiers above the previous 7,000 and 10,000 MAU limits on B2B and B2C Plans, respectively. This change will allow you to better evaluate cost as you anticipate scaling on the Auth0 platform. 

Again, if you would like to take advantage of these options, please contact our team by completing this [form](https://auth0.com/contact-us?place=header&type=button&text=contact%20sales). Please note you will need to move to a new plan with a yearly spend of $10,000 or more to take advantage of these options but we plan to include these add-ons via our self service plans (with a lower minimum) in the first half of 2024.

If you have further questions, please reach out to the [Auth0 Community](https://community.auth0.com/) (free plans) or submit a ticket in the[ Auth0 Support Center](https://support.auth0.com/) (paid plans).

## FAQs

* **Will the free plan still be available after November 1st, 2023?**
    * Yes, the free plan will continue to be available.
* **What’s the benefit of grouping tenants?**
    * All of your tenants can be managed in one place.
    * Entitlements, usage, etc. will be viewed together.
    * Increased security.
* **What is an Auth0 Team?**
    * Provides a single point of visibility and control over your Auth0 resources by providing centralized governance, compliance, and secure collaboration at scale. More information about Auth0 Teams can be found [here](https://auth0.com/docs/get-started/tenant-settings/auth0-teams#access-the-teams-dashboard). 
* **What if my tenants are already grouped?**
    * Nothing changes unless you make changes to your subscription.
    * If you make changes to your current plan, you will need to regroup your tenants since the plan structure differs.
* **What if I have multiple plans?**
    * Tenants will need to be grouped via [Auth0 Teams](https://auth0.com/docs/get-started/tenant-settings/auth0-teams#access-the-teams-dashboard).
* **What if my company is a development agency (dev shop)?**
    * Contact [Support](https://support.auth0.com/) to request an exemption. 
* **Can I stay on my current plan?**
    * Yes, assuming you are using one tenant and are within your usage limits you can stay on your current plan.
    * We will provide you with at least 90-days notice if we decide to move existing customers that are within their usage limits to the new plan structure.
* **Where can I find the new Terms of Service?**
    * Our updated Terms of Service can be found [here.](https://www.okta.com/auth0-pss-self-service/)
* **I’m on an enterprise plan and I have a self service tenant(s) as well. Do I have to move those to my enterprise plan?**
    * Yes, and it will be more beneficial for you to manage all tenants under a single account that has enterprise capabilities.
* **Can I pay by invoice now rather than credit card?**
    * Yes, for plans above $10,000/year you can sign a contract and pay by invoice rather than by credit card. To take advantage of this, please [contact us](https://auth0.com/contact-us).
* **What happens if I have more than 7 admins?**
    * New plans released on November 1st will only get up to 7 admins.
* **Can I get more than 10K MAUs on a self service plan?**
    * Yes, we now include MAU tiers beyond 10K MAU
* **Which MFA factors can be used with the Enterprise MFA add-on on professional plans?**

* **✅ Included**
    * SMS Notifications
    * Push Notifications
    * Voice Notifications
* **❌ Not Included**
    * WebAuthn with security keys
    * WebAuthn with device biometrics
    * Email Notifications

Pricing Changes for Auth0

shiven_ramji

Shiv is an experienced product executive and builder obsessed with creating beautiful products. He is the President of Auth0 at Okta, managing a $1B ARR business and overseeing the company’s product, data, security, and technology strategy and execution. Before Auth0 and Okta, Shiv was the SVP of Product at DigitalOcean, leading DigitalOcean’s products, pricing, and partnerships. Additionally, Shiv has held product leadership positions at global brands, including Amazon, NBCUniversal, LiveIntent, and The Nielsen Company. Shiv was the recipient of the 2023 Top Global CPO Award by the Products That Count community.

Beyond his current corporate focus, Shiv is deeply committed to fostering entrepreneurship and innovation, particularly in Africa. He is an active angel investor and startup advisor and also serves on the boards of [**Products That Count**](https://productsthatcount.com/) and [**Aiven.io**](http://Aiven.io).


President, Auth0

Shiven Ramji

Auth0 was placed into the Leader Quadrant for 2021, parent company Okta also named a Leader

We are proud to announce that Auth0, a product unit within Okta, has been recognized as a Leader in the 2021 Gartner Magic Quadrant for Access Management, Worldwide. Gartner defines the Access Management market as: "_The access management (AM) market is defined by customers’ needs to establish, enforce, and manage run-time access controls for internal and external types of identities, as well as machine identities, interacting with cloud, modern standards-based web and legacy web applications_" Auth0 focuses on SaaS-delivered developer-centric and Customer Identity and Access Management (CIAM) use cases.

For more information, please download the full 2021 Gartner Magic Quadrant for Access Management [report](https://auth0.com/resources/whitepapers/gartner-magic-quadrant-access-management).

![Access Management](https://images.ctfassets.net/23aumh6u8s0i/2R3F2vxbxOSS9HtrO3Odcf/f8351826feee0286580150623d6d53b4/Figure1_2.jpg)

The Magic Quadrant recognized Auth0 as a Leader based on our Ability to Execute and Completeness of Vision.  

Auth0 believes that CIAM should do more to balance the three forces of security, privacy and convenience — not just keeping the bad actors out, but also driving customer loyalty and conversion and revenue to create a great experience for our customers, partners, and their end-users.

We believe vendors' experience in the space is a key consideration for Gartner in their Magic Quadrant Evaluations. As stated by one of our customers in their [review](https://www.gartner.com/reviews/market/access-management/vendor/auth0/product/auth0-platform/review/view/1363099) of Auth0, included in the [2021 Gartner Peer Insights Voice of the Customer Access Management Report](https://auth0.com/resources/ebooks/gartner-peer-insights-ciam), Auth0 comes with great features out-of-the-box. We went live easily with Auth0 as our Identity Provider. The platform/vendor does not just support us in a technical angle, but also understanding our user journey and sharing their experience (with other clients) and what approaches to take to minimize risk and even enhance user experience during the migration. — VP, Core Product Development, Retail industry


## Auth0 / Okta Both Recognized as Leaders

Because [Okta closed the acquisition of Auth0 in May 2021](https://auth0.com/blog/okta-acquisition-announcement/), we believe we are both represented as vendors in the 2021 Magic Quadrant for Access Management. Our capabilities and visions were evaluated separately, but to great success — both Okta and Auth0 were recognized as Leaders.  
  
As we move forward we will combine Okta’s proven ability to execute and leadership in Workforce and CIAM with Auth0’s role as the innovator of a modern CIAM and developer experience. Together, Okta and Auth0 are the future of identity, working to solve every identity use case for customers.

## Next Steps with Okta

Bringing together two strong market leaders is a challenge — but we both see the positive impact this will bring for our customers and for the identity market. We know we have a lot of work ahead of us and will rely on customer feedback. We’re grateful for your trust as we continue to innovate with Okta.

_*Gartner, Inc., Magic Quadrant for Access Management, Henrique Teixeira, Michael Kelley, Abhyuday Data, November 1, 2021._

_This graphic was published by Gartner, Inc. as part of a larger research document and should be evaluated in the context of the entire document. The Gartner document is available upon request from Okta._

_Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. Gartner disclaims all warranties, express or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose._

_Gartner and Magic Quadrant are registered trademarks of Gartner, Inc. and/or its affiliates in the U.S. and internationally and is used herein with permission. All rights reserved_

_Gartner Peer Insights reviews constitute the subjective opinions of individual end users based on their own experiences and do not represent the views of Gartner or its affiliates._

Auth0 recognized as a Leader in the 2021 Gartner® Magic Quadrant™ Gartner Magic Quadrant for Access Management, Worldwide

eugenio-pace-new-avatar

Pace co-founded Auth0 in early 2013 with CTO and “brother-in-arms” Matias Woloski while living 7,000 miles apart from each other. Since then, Pace has played an instrumental role in growing Auth0 into a leading identity management company that is loved by developers and trusted by global enterprises. He loves traveling and has visited more than 35 countries for business and pleasure. He currently lives in Redmond, Washington with his wife, two sons, and their labrador retriever. In his spare time, he enjoys the outdoors, rowing, riding bikes, spending time with his family, restoring his 1970 Karmann Ghia, writing his blog, and reading history and philosophy.

CEO and Co-Founder

Eugenio Pace

Todd McKinnon

Todd McKinnon is the CEO and co-founder of Okta, the leading provider of enterprise identity, which he co-founded in 2009 with Frederic Kerrest. Under Todd’s leadership, Okta has transformed the way millions of people access technology and put identity at the forefront of security.

Todd’s experience as a leader and technology visionary spans more than 25 years, with deep roots in enterprise software and cloud transformation. Prior to Okta, he led engineering at Salesforce.com, where he grew the team from 15 people to more than 250, and the service from two million daily transactions to more than 150 million. Todd started his career at PeopleSoft, where he held a number of engineering and leadership roles throughout his 8-year tenure.

Todd earned his bachelor’s degree in management and information systems from Brigham Young University and his master’s in computer science from Cal Poly San Luis Obispo. A Bay Area native, Todd is an advisor to Family House and an advocate for equality and inclusion. He is a husband and father, an exercise addict, and a mountain bike enthusiast.

Okta CEO and co-founder

CEOs Todd McKinnon and Eugenio Pace highlight the exciting opportunities ahead for the combined company

Today, we’re bringing you Okta’s third [**Showcase**](https://www.okta.com/showcase/), joining forces virtually with teammates, customers, and partners from around the world for our annual fall event that provides an inside look at how the company is innovating. 

This year, it’s not just Okta taking the stage: it’s **Okta + Auth0**. Six months ago, we officially embarked on a mission to join our two companies and lead together in the customer identity and access management (CIAM) market with our shared worldview for a neutral, independent identity cloud. While we came from very different backgrounds, we both built our companies to innovate on identity from the ground up and prioritize customer success—so we connect on helping customers drive outcomes that matter most to them. Our cultures are strongly aligned with a strong focus on transparency and innovation, all with trust at the center. 

Since the acquisition closed in May, we’ve learned so much about our teams, companies, and technology. This partnership (eight years in the making!) has exceeded expectations beyond what we’ve imagined and has reinforced our commitment to continue investing in both platforms. We’ve invited both teams here today to share our joint story of growth, momentum, and strategy in the CIAM market. 

## The World Is Shifting to Identity-First

It has become clear that the role of identity in the world has evolved, and we’re here to address that shift. Together, Okta and Auth0 are reimagining identity’s role in every organization’s technology strategy. Cloud, mobile, and Bring Your Own Device (BYOD) have transformed the dynamics of the digital world over the past decade. At the same time, IT is struggling to keep up with all of these changes, and developers are more burdened than ever to build more applications quickly and without sacrificing security and user experience. Identity is the perimeter, and it’s at the heart of every technology choice and transformation. Governments globally are shifting to identity-first through initiatives like MFA mandates with Zero Trust security architecture. Customer experiences must be identity-first as companies rush to secure platforms and provide seamless, personalized experiences amidst a growing number of data breaches in the wake of the pandemic. 

This Showcase, we’re thrilled to introduce product innovation and joint momentum on the heels of the acquisition—all with the goal of helping organizations thrive in an identity-first world.

## Adopting an Identity-First Strategy with Okta + Auth0

The digital world is heterogeneous: we all work across multiple stacks, many clouds, and myriad applications. Digital experiences are connecting more companies, customers, and employees than ever before. Okta understands this need to connect. Through the [Okta Integration Network](https://www.okta.com/okta-integration-network/), we have the broadest and deepest set of independent and neutral integrations to securely connect to everything. And through our Workflows technology, we empower companies to weave the best employee and customer experience throughout those integrations and applications.

Okta Workflows is the key to simplifying and automating identity processes in an identity-first world at scale. We first introduced this technology to customers with democratization at the heart. Democratizing identity means providing everyone with the choice of tools and technology needed to harness it. Today we’re excited to announce **Workflows for Any Identity Use Case**, meaning our identity automation and orchestration solution is now available as a standalone product for all customers, including a no-cost option for up to five flows. We really mean anyone: anyone at any company, development or non-development teams alike, can now leverage the power and extensibility of identity in a low or no-code user interface. 

What’s more, we’re also introducing new connectors, including Jamf, Microsoft Teams, ITSM (FreshService), and alert management (OpsGenie), along with new templates such as app access requests with Slack. Okta Workflows helps customers solve highly complex use cases and now enables even more innovation to happen more securely and faster. 

We are also announcing the availability of the **Auth0 Identity Platform on Microsoft Azure**, offering customers the ability to choose Azure as a private cloud deployment option from Auth0. This addition provides customers with another secure cloud deployment option that better aligns with their technology stack and supports regional data residency needs, unlocking a comprehensive CIAM solution for organizations in regions where Azure has a larger infrastructure presence. Ultimately, more flexibility means more ways to deploy identity in the way that works best for each business. 

## Accelerating Momentum & Innovation in the CIAM Market

Every company connecting directly with customers must manage customer identities and the massive volumes of data and insight accompanying them. An identity-first, CX strategy is critical in a world where businesses feel increased urgency around digital transformation, security threats, and growing user experience demands.

As a joint Okta + Auth0 team, we can better meet the demands of a fast-growing CIAM market. When we look closely inside our customers’ technology environments, we see a wide range of situations—some are digital natives, others are building their first apps to connect with customers. While some live fully in the cloud, others choose a hybrid model, and some still manage massive legacy on-premises deployments. It’s within this diversity of technology environments that we see the biggest opportunity to make a difference.

To further our offerings in this space, we’re rolling out new CIAM capabilities across Okta’s CIAM offering, including **Device Authorization Grant, Branding**, and **Custom Administration Roles** to deliver universal customization from internal management and compliance to devices and customer-facing applications. These features address critical pain points across IT, security, and engineering when implementing identity and are rooted in choice and extensibility. Together, Okta and Auth0 now enable end-to-end customer journeys and address every use case imaginable, driving better digital customer experiences. 

With our combined company, we have one vision for identity. We’re ready to create solutions for all, offering more opportunities for current and future customers. The world now is identity-first; it ensures our environments are kept safe and secure and that every digital experience fits each customer’s needs. We’re just at the beginning of our journey together—we can’t wait to see what the future holds.

If you missed the live event, you can watch the [**on-demand content**](https://www.okta.com/showcase/) beginning on October 14.

<include src="asides/AboutAuth0" />

Okta + Auth0 Showcase 2021: Identity for All

auziros:jeana-tahnk

Jeana has been in the tech industry for 15+ years, both as a communications professional and writer. As Director of Global Communications at Auth0, she works with her internal team and external agencies to amplify the company's visibility worldwide and establish its leadership in the identity industry. When she is not working, she can most likely be found on a field watching one of her three kids playing sports, or cleaning up after her one-year-old retriever who chews everything.

Senior Director, Global Communications

Jeana Tahnk

Former DEI and employee engagement lead at Nike and Target to guide company’s DEI efforts

**BELLEVUE, Wash. – May 24, 2021 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced that [Natalie Hausia-Haugen](https://www.linkedin.com/in/natalie-hausia-haugen-she-her-3869a4114/) has joined the company as Head of Diversity, Equity, and Inclusion (DEI). Hausia-Haugen brings more than 15 years of industry experience and will be responsible for accelerating Auth0’s DEI vision, policies and processes, and further developing Auth0’s culture of inclusion and belonging.

Prior to joining Auth0, Hausia-Haugen worked at Nike, where she held senior employee engagement, diversity and inclusion, and people-related roles. She was a leader on Nike’s diversity and inclusion employee council and the co-chair of Nike’s employee resources group for teammates of color with roots in Asia, the Middle East, and the Pacific Islands. Before Nike, Natalie worked for Target, Inc. leading both local and national diversity and inclusion strategies.  

“Since Auth0’s inception, we have aimed to create a safe workplace and culture where every person can show up as their authentic self, speak their truth, learn, develop, and grow—at a global scale—and Natalie will play a key role in strengthening our efforts,” said Carolyn Moore, SVP of People at Auth0. “DEI is a top priority for Auth0, and we are honored to have Natalie join our team in this newly-created role to help us continue to make a meaningful difference.”

Auth0’s DEI initiatives are shaped by the belief that there is value and power in hiring and nurturing teams of people from diverse backgrounds, beliefs, and human experiences. Auth0, [recently acquired by Okta](https://auth0.com/blog/okta-acquisition-announcement/), was recognized by Forbes as one of [America’s Best Startup Employers 2021 List](https://www.forbes.com/americas-best-startup-employers/#3ea4dc906527) (ranked #11 out of 500) and by Fortune as one of the [30 Best Small and Medium Workplaces in Technology](https://fortune.com/best-small-workplaces-technology/2021/auth0/) (ranked #7 out of 30), as well as by [Best Companies](https://www.b.co.uk/), and [Great Place to Work](https://www.greatplacetowork.com/certified-company/7018610) for its company culture, leadership, and commitment to its people.

“Auth0’s belief in and commitment to the importance of diversity, equity, and inclusion is truly remarkable and has been core to the company since day one—the team deeply cares and strives to create new standards, strengthen existing practices, and embolden others,” said Hausia-Haugen. “I’m proud to join a team that is dedicated to its talented people and culture and passionate about fostering a space where courage, real freedom, and our shared humanity meet.” 

To learn more about Hausia-Haugen and Auth0’s DEI efforts, visit [Auth0’s blog](https://auth0.com/blog/auth0-welcomes-natalie-hausia-haugen-to-the-team).

## About Auth0

The Auth0 Identity Platform, a product unit within Okta, takes a modern approach to identity and enables organizations to provide secure access to any application, for any user. Auth0 is a highly customizable platform that is as simple as development teams want, and as flexible as they need. Safeguarding billions of login transactions each month, Auth0 delivers convenience, privacy, and security so customers can focus on innovation. For more information, visit [https://auth0.com](https://auth0.com).

### Media Contacts
Global Communications<br />
Auth0<br />
[press@auth0.com](mailto:press@auth0.com)<br />

Matter for Auth0<br />
[auth0@matternow.com](mailto:auth0@matternow.com)<br />

Natalie Hausia-Haugen Joins Auth0 as First Head of Diversity, Equity, and Inclusion

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

The tech market in Latin America is growing; Auth0 can help you keep up with a scalable identity solution.

The number of Venture Capital deals signed in Latin America hit a record high of 488 in 2020. That’s nearly double the 2017 number according to [Bloomberg](https://www.bloomberg.com/news/articles/2021-03-16/latin-american-startups-had-record-venture-capital-deals-in-2020). The growth in the tech market in LatAm isn’t only apparent in new startup deals; companies who already have a presence in the region are expanding both through mergers and acquisitions and by looking into new countries to grow their footprint in the region. 

Each scenario brings its own challenges for your IT infrastructure, particularly your[ identity solution](https://auth0.com/blog/how-to-scale-quickly-with-identity/). If you’re expanding into a new country, there’s likely to be a different data privacy regulation you’ll have to comply with. And that startup you’re eyeing probably has a vastly different infrastructure than yours, whether private or public cloud or even legacy on-prem. An Identity management solution has to be able to expand and flex in order to grow with your company, regardless of the specific scenario.

![Business Expansion](https://images.ctfassets.net/23aumh6u8s0i/1HnNeEEQ4hCBb2M4y2ZerT/5b5a1de004ea8021fdc38d042a85a672/Latam05.jpg)

## With Business Expansion Come Business Questions

Let’s take a look at those two potential growth scenarios and what they mean for your business’s identity solution. First up is the acquisition of a competitor or related smaller entity. [Mergers and acquisitions](https://auth0.com/blog/why-your-ma-strategy-has-to-include-an-iam-solution/) (M&A) always bring an array of unique challenges, but for this article, we’re going to focus on the identity challenges associated with the merging of IT infrastructure.

Your web app may be hosted on a public cloud, but the company you just bought has been in business for a while and is still using on-prem hosting for theirs. In order for you to bring both properties together under one identity solution, you need one that can bridge the gap between the two, allowing your new audience access to both apps without managing multiple sets of credentials.

In our second scenario, your organization is considering an expansion into a neighboring country to take advantage of the easing of business restrictions and the growing market for your product that your marketing team has identified. You already comply with the privacy regulations in your country, but are you ready to comply with those abroad? 

Is your organization ready to answer questions like these:

* Can our existing in-house identity platform scale to include our hybrid-cloud infrastructure and the legacy system our latest acquisition uses?
* Is our identity solution ready to handle the influx of new user accounts and login requests when we roll out to our new market?
* Is our consent gathering process in compliance with the regulations in the country we’re expanding into?

If not, or if the answer to any of these questions is “no,” it may be time to consult with an identity specialist. 

<include src="TweetQuote" quoteText="Auth0 recommends you always consult legal counsel when it comes to complying with data privacy regulations." />

## Auth0 Is the Identity Solution That Scales With You

Both of these scenarios mean you’re going to be scaling your infrastructure, adding users to existing web apps, and even adding new web apps. Having an identity solution in place that can easily expand to include controlling access to these new properties can help reign in costs and speed your time to market post-expansion. Our customers tell us that by using Auth0 for their authentication and identity needs, they took their time-to-value from months or years down to weeks or even days.

Credit card company [Visa reported](https://www.marketwatch.com/story/visa-sees-massive-digital-acceleration-with-millions-trying-e-commerce-for-the-first-time-2020-05-13) that during just the first month of the COVID-19 pandemic, more than 13 million cardholders in Latin America made their very first e-commerce transaction. That’s 13 million new accounts being created, 13 million new logins, and 13 million opportunities for identity to go wrong if your solution isn’t scalable. There are many aspects to what makes something scalable. When it comes to identity, we see five as being the most important.

1. **Bridging legacy and cloud systems**

One of the downsides to M&A is that your IT department inherits the backend infrastructure of the other company, for better or worse. Auth0’s extensive SDK libraries and robust APIs mean it’s a simple matter to bridge the gap between legacy systems and modern cloud-first ones. One login box can take your current and new customers to both web apps, no matter where they’re hosted. This ability also speeds your time to value because your developers can maintain focus on their core product delivery rather than piecing together connectivity solutions that may only work for a short time.

2. **Single source of truth for customer data**

Bringing all of your customer data together into one single source of truth (SSoT) makes it that much easier to protect. It also speeds access when a user logs in, as no matter which property they’re using, it has only one place to look to find their credentials, rather than scouring multiple data silos.

3. **Single sign-on**

Customers want low-friction experiences online, and being able to create an account using credentials they already have is a great way to win them over. Single sign-on (using account information from a provider like Apple, Facebook, or Twitter) allows a customer to create an account on your site quickly and easily, and without the need to create and remember a new password.

4. **Breach protection**

The issue of passwords brings us to a major sticking point for many identity solutions, protecting user information from data breaches. According to the most recent [IBM/Ponemon Cost of a Data Breach Study](https://www.ibm.com/security/data-breach), the global average cost of a breach is now $3.86 million (USD). And Verizon reports in their [2021 Data Breach Investigations Report](https://www.verizon.com/business/resources/reports/dbir/) that 61% of breaches involve misuse of credentials. Put those together, and you see why protecting your customers’ information is such a major piece of scaling your online business presence and why a robust identity solution needs to take this aspect into account.

5. **Protection from staffing fluctuations**

An often overlooked aspect of identity projects is the simple fact that people change jobs. If you have an identity tool that was developed in-house two years ago, there’s a good chance you won’t have anyone on staff who can expand it to cover your new properties. That will delay roll-out and extend your time-to-market. 

[Auth0 customer WABI](https://auth0.com/case-studies/wabipay/) is modernizing e-commerce in Latin America. They’re currently active in 11 countries and have expansion plans to add four more in 2021. And they’re trusting Auth0 to scale their identity solution to match these ambitious plans. “WABI is scalable, and we need a partner that is, too. We believe Auth0 will support us in getting there.” Says WABI Business Manager Juan Manuel Mingo. With their planned expansion opening their market to millions of potential new customers, WABI knows they need a robust identity platform that’s ready to handle the influx of new users.

## Auth0 Brings Global Experience to Your Latin America Growth Plans

Our founders are from Argentina, the company was started in the United States, and we currently have people in 30+ countries with more being added every day. Our [international team](https://auth0.com/blog/auth0-expands-global-partner-network-in-latin-america-with-clm/) of identity specialists can help you work out your identity needs and help get you set up with an identity as a service (IDaaS) platform that is ready to grow with your company, no matter what your expansion plans look like. We know that having an identity solution designed to be extensible and flexible to move with your business can mean the difference between a successful rollout or a failed acquisition attempt. 

Auth0 is built on open standards, making it easy to connect with existing systems and varying infrastructure scenarios. Bridging the gap between a public cloud-based web app and an on-prem user database is only the beginning. Our extensive marketplace of integrations means you can connect with your existing business software solutions as well.

Our breach protection includes features such as [bot detection](https://auth0.com/docs/attack-protection/bot-detection), [adaptive MFA](https://auth0.com/multifactor-authentication), [single sign-on](https://auth0.com/single-sign-on), and [passwordless](https://auth0.com/passwordless) flows. And the [Auth0 Marketplace](https://marketplace.auth0.com/) has what you need to handle everything from consent management to business process software integrations. The protections and extensibility we offer is a key factor in our scalability. 

When the time comes to expand across borders, Auth0 is ready. We’re certified by a third party as compliant with the International Standards Organization (ISO) standards [ISO27001](https://www.iso.org/obp/ui/#iso:std:iso-iec:27001:ed-2:v1:en) and [ISO27018](https://www.iso.org/standard/61498.html) for handling information security and personally identifiable information (PII) as a cloud provider.

![Growing](https://images.ctfassets.net/23aumh6u8s0i/1sBMtrIri0sAw0OBkWE4QV/41d7fc8b0740ac05ec3c82145fd1478f/Latam06.jpg)

## Auth0 is the Identity Solution That Can Keep Up With The Growing LatAm Market

To provide your customers with a continuous, low-friction, and intuitive login flow requires a robust identity solution. Whether you’re scaling internationally or your growth plans call for staying closer to home, Auth0 can provide the IDaaS platform you need to maintain a great customer experience while ensuring the security and privacy of your customer data. And don’t worry if you’ve already started an identity project and hit a stumbling block, [our experts can help](https://auth0.com/contact-us). 

<include src="asides/AboutAuth0" />

Can Your Identity Solution Grow With Your Company?

dave-wilner

Dave Wilner is the Chief Revenue Officer for Auth0, responsible for all field teams including Sales, Marketing, Professional Services, Support and Customer Success.<br /> Dave has spent the last two+ decades in executive roles at high growth, highly successful software companies.<br /> In another life, Dave was also a litigation partner at AmLaw 100 international firm Cozen O’Connor. In this life, Dave lives in Issaquah, WA with his wife Brenda and their two sons, and their adopted pit bulls Bo and Mona.

Chief Revenue Officer

Dave Wilner

Turning away business that conflicts with company values



I’ve worn my politics on my sleeve at work for the last few years. I’ve made countless snide comments about the Trump administration around the water cooler, sent hysterical (to me) Mitch McConnell memes to team members, and proudly worn my _Fuck the NRA_ t-shirt to work at least a half dozen times. But as our little-engine-that-could company grew to nine-figure revenue, and my own team grew to 400+ folks, I made a conscious effort to dial it back. One recent area where I needed to speak with a more neutral, empathetic voice was around deciding with whom the company chooses to do business. 

We live in a world where consumers increasingly make their voices heard and spend their money with brands that share their values. Over the last few years, we’ve also seen corporations &mdash; particularly in tech &mdash; begin taking stands on social issues. One early example was Marc Benioff of Salesforce speaking out strongly against the state of Indiana after it passed its so-called “religious freedom” law and North Carolina following the passage of its “bathroom law.” Since that time, we’ve seen stands taken by tech companies against the likes of ICE, the NRA, far-right “news” outlets, and others.

Most recently, this issue was thrown back into the global spotlight following the decision of Amazon and other tech companies to deny Parler’s use of their platforms. 

The brands that their companies affiliate with and serve has also increased in importance to employees. A rash of studies over the past few years have illustrated that pride in the work done by their company is a critical macro factor in employee satisfaction and attrition. Put simply: an increasing percentage of employees will quit if they have values-based objections to who consumes their companies’ IP. Those values and beliefs, however, are seldom homogenous across an employee base.

## So Who Decides? 

How does a company walk the line between running a for-profit endeavor and turning away business that some portion of its employee base may find objectionable? In other words, how as a leader can you drive your company to take a stand when there may not necessarily be a unanimous view around what that stand should be?

Some scenarios are obvious. If the Aryan Nations decided to have a reboot, launched a recruiting website, and attempted to sign up for my company’s authentication service, I think very few employees would be hard-pressed to grouse if we chose to turn that business away.

Similarly, if a dark web organization associated with human trafficking in some way attempted to integrate our technology into a platform to support its endeavors, we would have no compunction about shutting that down.

The problem lies in the nuance. What about a religious organization that &mdash; while employing exclusionary practices towards the LGBT community &mdash; provides homeless shelters that house and feed hundreds of folks every night?

Or the far-right political party that promotes wild conspiracy theories that &mdash; while wholly unsupported and having no basis in fact &mdash; do not promote violence or hate speech or otherwise run afoul of the law?

More than ever, employees are conscious of the social stance that their employers take and insist on having a voice in those corporate positions. How do we balance the views of a widely disparate and heterogeneous workforce in a way that allows everyone to be proud of the organization where they work?

## Getting Started: Calling out the Issue

We set out to take a whack at this problem last summer. In the absence of a playbook or illustrative examples, we started at the beginning: bluntly, transparently explaining the issue and noting the challenges to our employees. 

We highlighted our values, including our support of diversity and inclusion across boundaries of race, color, sex, national origin, religion, age, disability, gender identity or expression, marital status, pregnancy, sexual orientation, political affiliation, union membership, or veteran status. 

We noted our license terms, which preclude using our technology for a variety of nefarious and/or illegal aims.
And then importantly, perhaps most importantly, we highlighted our support of each employee’s right to their own personal views on political and social issues, provided those views do not impact our ability to honor and uphold our corporate values. We noted that one of our challenges as a business is to stay true to our core values while also accepting that our company is composed of folks that have different views and opinions about a myriad of political and other issues.

## Encouraging Dialogue

The next step in that process was soliciting feedback from our employees — asking those that were so inclined to fill out an anonymous survey about how they felt we should handle this difficult problem.

Given how vocal and socially active many in tech are, we were not surprised to receive feedback from well over 20% of our employees. What we were surprised by, however, was the quality of and perspective displayed in the answers. Here’s a sampling: 

* _I’m so proud that we aren’t hiding from this, even though it’s such a hard issue._
* _I feel very strongly about my own views, but I can appreciate that my views shouldn’t count more than any of my peers._
* _I think we’ll find that it will be impossible to make everyone happy, but I think we should be ok with that, as long as we all believe in the process we come up with._


## From Ideation to Policy

Here’s where we ultimately landed:

**1: The most important thing is to have a dialogue**. So many of our team members simply appreciated the fact that we took the time to dig in and talk through the issue. Beyond that, though, most employees understood the importance of recognizing differing views and that the vitriol with which they may view a certain company may not be shared by all. We were pleased with the balance and perspective we got back from the team here.

**2: Next, cleanly document the easy stuff**. We made it explicit that we would turn away business with entities that clearly violated local law or the acceptable use policy in our license agreement. Though most folks would assume this will be the case, the reinforcement and clarity were positive.

**3: Then take a whack at the hard stuff** &mdash; the decisions where different viewpoints and different opinions could lead to different results. We started with corporations or entities with policies or actions that have the impact of discriminating in hiring, promoting, or which adhere on the basis of race, gender, sexual orientation, gender identity, and veteran status. We laid out a policy whereby an employee could raise an objection to such an entity, and that objection would be reviewed by an internal committee. In making a determination as to whether to work with or continue working with such a company, we would evaluate a number of factors, including:

  * The extent of the discriminatory impact
  * Whether contrition had been made or any steps toward remediation undertaken 
  * If the company/entity provides other value to the world that might outweigh any alleged discrimination

Again, feedback from employees here was overwhelmingly positive. In particular, folks valued a predetermined set of criteria, as imperfect as it might be, as well as the notion of a committee to make decisions versus a unilateral executive decision. The transparency of this process, however, was the characteristic that resonated most with the team.

**4: Give employees a clear process to raise issues**. We clearly outlined the manner in which employees could raise objections to certain entities, and how that objection will be reviewed by the designated team, and a timeline for adjudication. We posted the process on the company Wiki page. 

Candidly, we felt the policy was a bit underwhelming. It’s short on details, long on vagaries and generalities. But we found it’s sufficient for its purpose &mdash; to include our employees in these decisions and foster a sense of inclusion and transparency. The simple fact that we were interested in the issue, and committed to an intentional process, helped our team members feel heard. Soliciting their feedback and providing an escalation path ensures that any strong viewpoints will have an avenue to be raised and considered. 

We know this is just the start and that there will be difficult questions in the future, but we believe that this groundwork can help any organization tackle those questions as a team.


When to Say Thanks... but No Thanks...

annybell-villarroel

Anny believes in a people-centric trust-based approach for security culture and awareness &mdash; one where we help people learn about cybersecurity in a fun way, and make them feel empowered, rather than afraid. She also leads the Madrid chapter for WoSEC &mdash; Women of Security.

Security Culture Manager

Annybell Villarroel

How to safeguard yourself and your company against phishing attacks on identity



Do you remember the last time you fell or almost fell for a phishing email? I do.

I received an email on my phone, apparently from an Amazon.com email address, that said, “Unlock your Amazon account.” Although this was unexpected, it was feasible because I had made a purchase on Amazon recently and had changed settings that could have locked the account.

Concerned, I opened the email.

The design matched Amazon’s style, there were no typos, and my phone’s email app interface showed me just the sender’s name rather than their email. I inspected the link the email asked me to click and noticed it was fake.

It was one of the best phishing emails I’ve received recently. It managed to make me feel concerned while reading it. That’s the key.

Phishing is both simple to implement and effective. It’s a relatively low-effort attack that can have a high reward. According to Verizon’s [2020 Data Breach Investigations Report](https://enterprise.verizon.com/resources/reports/dbir/), attackers used phishing in 22% of the investigated breaches. The quality of the attacks varies from the obviously fake to sophisticated spearphishing campaigns that are fully customized.

The most effective phishing emails are typically those that tap into strong emotions that drive action. In _Thinking, Fast and Slow_, Daniel Kahneman, Nobel Laureate in Economics, proposed that humans have two modes of thought: “System 1,” which is fast, instinctive, emotional, and “System 2,” which is slower, more deliberative, and more logical. Humans feel before we think. We are emotional beings. That’s why phishing attacks that appeal to our emotions (anxiety, fear) are more effective. 

## Phishing Attack Goals 

Phishing attacks tend to have three main goals:

### Credential theft

Credential theft typically involves a link that sends the user to a fake look-alike website that requests credentials to login.

If the account is not properly secured with methods like [multi-factor authentication (MFA)](https://auth0.com/docs/mfa), the credentials obtained could result in an account takeover. The compromised account could then be used to access internal systems, which could cause a data breach that could have compliance-related consequences under data privacy laws such as the [GDPR and CCPA](https://auth0.com/resources/whitepapers/GDPR-vs-CCPA).

### Business email compromise

This kind of attack involves impersonating an executive to trick someone into transferring funds or buying gift cards. This could have a high financial cost to the organization if it succeeds.

### Malware delivery

Malware delivery usually involves downloading an infected document or app that can cause a high-impact disruption, like what happened with the [2017 WannaCry ransomware attack](https://www.malwarebytes.com/ransomware/).

## Preventative Measures

The following measures can help you protect yourself, your employees, and your users from phishing attacks:

### Security awareness

Empowering users to detect and report phishing attacks helps protect the organization no matter the type of phishing. It also helps the security team react faster, thanks to their reports. We’re providing a free user awareness guide to help you raise awareness internally, and we’ve released some of our internal phishing training in our YouTube channel voiced by someone you would not expect. 😉

### Multi-factor authentication (MFA)

MFA protects your employees from an account takeover in the event of credential theft. Implementing and rolling it out is very easy with Auth0.

### Endpoint protection

Antivirus solutions can protect your employees in the event of malware. There are plenty of options for the enterprise, so choosing one that fits your organization and culture will boost your defenses with minimal disruption.

### Verification processes for payments and invoices

Establish an internal verification process that requires multiple people to approve a payment or expense before wiring the money, and define specific methods to do so (e.g., no gift cards).

On top of all of this, it’s key that users have an easy way to report these attacks to your IT or security team, such as a dedicated corporate email address, and that the team can efficiently respond to these reports.

## A Constant, Evolving Threat

Phishing is an ever-evolving threat that’s constantly present for most companies across all industries, as well as most end-users. Whether it’s generic bait or a message adapted to the circumstances of the moment, phishing can happen at any time to any company or any user. Rather than being overwhelmed by the challenge, training employees, creating and sharing clear processes, and enabling measures like enforced MFA can be the difference between a bad data breach and creating a resilient organization with the ability to adapt in an evolving threat landscape.

To learn more about how to protect your valuable data from attack, explore [Auth0 Resources](https://auth0.com/resources/).

<include src="asides/AboutAuth0" />


Protecting Against Phishing Attacks

Recognition highlights Auth0 as a top private cloud company for third consecutive year



**BELLEVUE, Wash. – September 16, 2020 –** [Auth0](http://www.auth0.com/), the identity platform for application teams, has been named to the [2020 Forbes Cloud 100](http://www.forbes.com/cloud100), ranking 19th out of 100 companies listed. The Forbes Cloud 100 is the definitive list ranking of the top 100 private cloud companies in the world, published by Forbes in partnership with [Bessemer Venture Partners](https://www.bvp.com/) and [Salesforce Ventures](https://www.salesforce.com/company/ventures/). Auth0 was also included on the list in [2019](https://auth0.com/blog/auth0-is-named-to-the-forbes-2019-cloud-100/) and [2018](https://auth0.com/blog/auth0-named-to-forbes-2018-cloud-100/).

As part of the rigorous selection process for the 2020 Forbes Cloud 100, Bessemer Venture Partners received submissions from hundreds of cloud startups. The Cloud 100 Judging Panel, made up of public cloud company CEOs, reviewed the data to select, score, and rank the top 100 private cloud companies from all over the world. The evaluation process involved ranking companies across four factors: market leadership (35%), estimated valuation (30%), operating metrics (20%), and people & culture (15%).

"Being included on the Forbes Cloud 100 for the third year in a row is an honor and an accolade we are incredibly grateful for. Thank you to Forbes, Bessemer Venture Partners, and Salesforce Ventures for their continual recognition of Auth0," said Eugenio Pace, CEO and co-founder of Auth0. "As companies and end-users give more of themselves away online, protecting personal data and user credentials is of paramount importance. We are proud to secure the digital world and serve as a key enabler in our customers' digital transformation and identity management efforts." 

Auth0 recently closed a [$120 million round of Series F funding](https://auth0.com/blog/auth0-helping-navigate-through-times-of-transformation/) in July, bringing the company's valuation to $1.92 billion and total capital raised to more than $330 million. Auth0's Series F round comes a little more than a year after the close of its [$103 million Series E funding](https://auth0.com/blog/auth0-closes-103m-in-funding-passes-1b-valuation/) last May, which launched the company into 'unicorn' status. After growing 70% in 2019, Auth0's rapid growth has continued through 2020 despite the uncertainty of the current global economic environment.

"The private cloud ecosystem continues to mature in light of rapid digital transformations, making the competition to land one of the coveted spots on the Cloud 100 list steeper than ever," said Byron Deeter, a top cloud investor, and partner at Bessemer Venture Partners. "Private cloud valuations are getting bigger as the market's appetite for cloud continues to grow. Over the past five years, the average Cloud 100 valuation has grown by a tremendous 2.5x, from $1 billion in 2016 to $2.7 billion in 2020. In fact, our 2020 Cloud 100 includes over 87 private cloud unicorns. These founders represent the absolute best in cloud computing today, and they will most certainly follow in the footsteps of our esteemed Cloud 100 alumni. More than a third of the companies of the Cloud 100 have exited either via strategic M&A, financial M&A or Initial Public Offering. Congratulations to these cloud leaders."

"In the face of this unprecedented time, digital is an urgent imperative, and the pace of innovation is accelerating. Companies around the globe, across all industries must adopt cloud technologies to enable their digital transformation," said Matt Garratt, Managing Partner, Salesforce Ventures. "The opportunity is massive for the cloud – there are now more than 25 public SaaS companies valued at over $10 billion whereas even five years ago there were only three. Sectors from collaboration and security to retail and healthcare, are being disrupted and becoming more digital. Salesforce Ventures is excited to be partnering with Bessemer Venture Partners and Forbes for the fifth year in a row to recognize those who are not just predicting what's coming but working to create the future."

"For five years now, we have ranked the best and brightest emerging companies in the cloud sector," said Alex Konrad, Forbes editor of The Cloud 100. "With so many businesses growing fast in the cloud, from data infrastructure to marketing, it's harder than ever to make the Cloud 100 list – but with more elite company if you do. Congratulations to each of the 2020 Cloud 100 honorees and the 20 Rising Stars honorees poised to join their ranks."

The 2020 Forbes Cloud 100 and 20 Rising Stars lists are published online at [www.forbes.com/cloud100](http://www.forbes.com/cloud100) and will appear in the September 2020 issue of Forbes magazine.

<include src="asides/AboutAuth0" />

## About Bessemer Venture Partners
Bessemer Venture Partners is the world's most experienced early-stage venture capital firm. With a portfolio of more than 200 companies, Bessemer helps visionary entrepreneurs lay strong foundations to create companies that matter, and supports them through every stage of their growth. The firm has backed more than 120 IPOs, including Pinterest, Shopify, Yelp, LinkedIn, Skype, LifeLock, Twilio, SendGrid, PagerDuty, DocuSign, Wix, and MindBody. Bessemer's 15 partners operate from offices in Silicon Valley, San Francisco, New York City, Boston, Israel, and India. For more information, please visit [www.bvp.com](http://www.bvp.com/).

## About Forbes
The defining voice of entrepreneurial capitalism, Forbes champions success by celebrating those who have made it, and those who aspire to make it. Forbes convenes and curates the most influential leaders and entrepreneurs who are driving change, transforming business and making a significant impact on the world. The Forbes brand today reaches more than 160 million people worldwide through its trusted journalism, signature LIVE and Forbes Virtual events, custom marketing programs and 40 licensed local editions in 70 countries. Forbes Media's brand extensions include real estate, education and financial services license agreements. For more information, visit the [Forbes News Hub](https://www.forbes.com/pr/#47fadf455a1c) or [Forbes Connect](https://www.forbes.com/connect/).

## About Salesforce Ventures
Salesforce is the global leader in Customer Relationship Management (CRM), bringing companies closer to their customers in the digital age. Salesforce Ventures, the global investment arm of Salesforce, invests in the next generation of enterprise technology that extends the power of the Salesforce Platform. Salesforce Ventures is building the world's largest ecosystem of enterprise cloud companies and extending that technology to customers. Portfolio companies receive funding, strategic advisory, and operating support, and can easily join [Pledge 1%](https://pledge1percent.org/) to make giving back part of their business model. Salesforce Ventures has invested in more than 400 companies, including DocuSign, GoCardless, Guild Education, nCino, Twilio, Zoom, and others across 22 countries since 2009. For more information, please visit [www.salesforce.com/ventures](http://www.salesforce.com/ventures).

### Media Contacts
Jeana Tahnk<br />
Global Communications<br />
Auth0<br />
[press@auth0.com](mailto:press@auth0.com)<br />
 
Hannah Carroll<br />
Matter for Auth0<br />
[auth0@matternow.com](mailto:auth0@matternow.com)


Auth0 is Named to the 2020 Forbes Cloud 100

Continued company growth underscores importance of identity management in digital transformation



**BELLEVUE, Wash. – July 14, 2020 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced it has closed a $120 million round of Series F funding, which brings Auth0’s valuation to $1.92 billion and total capital raised to more than $330 million. The funds will help fuel continued innovation and go-to-market expansion, responding to global demand for a simple, extensible identity platform that provides secure access to any application. 

Led by Salesforce Ventures, the round included another new investor, DTCP, as well as participation by existing investors Bessemer Venture Partners, Sapphire Ventures, Meritech Capital, World Innovation Lab, Trinity Ventures, Telstra Ventures, and K9 Ventures.

Auth0’s Series F round comes a little more than a year after the close of its [$103 million Series E funding](https://auth0.com/blog/auth0-closes-103m-in-funding-passes-1b-valuation/) last May, which launched the company into ‘unicorn’ status. After growing 70% in 2019, Auth0’s rapid growth has continued through Q2 2020 despite the uncertainty of the current global economic environment.

Auth0 continues to quickly expand its customer base, underscoring that identity management plays a critical role in digital transformation and in enabling access to customer applications. Thousands of customers outsource their identity management to Auth0 to help offload the burden of maintaining complex systems and enjoy faster time-to-market and frictionless end-user experiences. 

“Auth0 is a leader in the large, fast-growing identity management market and has shown tremendous growth at scale,” said John Somorjai, EVP, Corporate Development & Salesforce Ventures at Salesforce. “Auth0’s expertise in end-to-end identity products is well-aligned with Salesforce's Customer 360 platform. We look forward to supporting their growth with this new strategic investment from Salesforce Ventures to drive further innovation for customers.” 

“Now, more than ever, safeguarding user access on all devices and connections is of paramount importance,” said Jack Young, partner and head of venture capital at DTCP. “Auth0 has positioned itself as a leader in Identity-as-a-Service and has gained the trust of application developers with its flexible, drop-in user identity management solution. We will use our European roots and strategic global network to help the Auth0 team continue along its growth track.”

“Achieving a Series F round of funding is an incredible milestone for our company, and we could not be more grateful to our new and existing investors for their support,” said Eugenio Pace, CEO, and co-founder of Auth0. “Nearly every app and service relies on secure authentication and seamless user experience. Our year-over-year growth is reflective of the persistent problem that our technology is solving, and we are so proud to be part of our customers’ journey.” 

Auth0 employs approximately 650 employees worldwide and continues to be recognized as a leading private company, with inclusion in the [Forbes 2019 Cloud 100](https://auth0.com/blog/auth0-is-named-to-the-forbes-2019-cloud-100/), [Deloitte’s Technology Fast 500](https://auth0.com/blog/auth0-ranked-as-one-of-north-americas-fastest-growing-companies/), and other [notable awards](https://auth0.com/press/awards/). 

## About Salesforce Ventures 

Salesforce is the global leader in Customer Relationship Management (CRM), bringing companies closer to their customers in the digital age. Salesforce Ventures, the global investment arm of Salesforce, invests in the next generation of enterprise technology that extends the power of the Salesforce Platform. Salesforce Ventures is building the world's largest ecosystem of enterprise cloud companies and extending that technology to customers. Portfolio companies receive funding, strategic advisory, and operating support, and can easily join [Pledge 1%](https://pledge1percent.org/) to make giving back part of their business model. Salesforce Ventures has invested in more than 400 companies, including DocuSign, GoCardless, Guild Education, nCino, Twilio, Zoom, and others across 22 countries since 2009. For more information, please visit [www.salesforce.com/ventures](https://www.salesforce.com/company/ventures/). 
 
## About DTCP

DTCP is an investment management group with $1.7 billion in assets under management and advisory from corporate and institutional investors, and a portfolio of over 60 companies. The group provides venture and growth capital, private equity, and advisory services to the technology, media, and telecommunications sectors. It operates and invests in Europe, North America, and Asia out of its Hamburg, San Francisco, Tel Aviv, and Seoul offices. To learn more about DTCP, visit [dtcp.capital](https://www.dtcp.capital/), [www.linkedin.com/dtcp-capital](https://www.linkedin.com/company/dtcp-capital/), or [@dtcp_capital](https://twitter.com/dtcp_capital) on Twitter.
 
<include src="asides/AboutAuth0" />

### Media Contacts
Jeana Tahnk<br>
Auth0 Global Communications<br>
[press@auth0.com](mailto:press@auth0.com)

Hannah Carroll<br>
Matter for Auth0<br>
[auth0@matternow.com](mailto:auth0@matternow.com)


Auth0 Announces $120M in Series F Funding

0cd73f2f2f39709bd03646e9225cc3d3?s=200 avatar

0cd73f2f2f39709bd03646e9225cc3d3?s=200

I’m an engineer with a passion for building frictionless products. I’ve built effective teams and have grown them into successful engineering organizations. I like to forge a culture.

CTO and Co-founder

Matias Woloski

We acquired Apility.io, an anti-abuse API company that will help us bolster our security strategy to protect against automated cyberattacks.



<div class="alert alert-info alert-icon">
  <i class="icon-budicon-487"></i>
  <strong>Important Information</strong><br> 
  <b>The Apility.io and Signals web properties and public APIs are no longer available. For more details, please refer to this <a href="https://auth0.com/blog/auth0-sunsets-signals/">blog post</a>.</b><br> 
</div>

Today we are announcing the acquisition of Apility.io, an anti-abuse API company. This is our first acquisition, bolstering our security strategy to protect against automated and targeted cyberattacks, including credential stuffing and sophisticated phishing attacks.

Apility.io is now a part of Auth0 Signals, a new collection of dynamic data feeds that fuels [Auth0's Anomaly Detection Engine](https://auth0.com/learn/anomaly-detection/) to detect and prevent sophisticated cyberattacks. In addition, part of Auth0 Signals will be made available as a community version via free APIs to help anyone better protect themselves from threat actors.

**To try out Auth0 IP Signals, our first free Signals API, visit [auth0.com/signals/ip](https://auth0.com/signals/ip)**

## What is Auth0 Signals?

Auth0 Signals is a collection of dynamic data feeds that enable our adaptive authentication pipeline to produce high-quality user confidence scores.

Our authentication pipeline processes an ever-expanding number of Signals to assess the risk of a login attempt, account creation, token refresh, or elevation of privilege. It then produces a confidence score. Using this score, Auth0 and our customers can perform risk-based adaptive authentication decisions.

<script src="https://fast.wistia.com/embed/medias/h5fqhdgsep.jsonp" async></script><script src="https://fast.wistia.com/assets/external/E-v1.js" async></script><div class="wistia_responsive_padding" style="padding:74.37% 0 0 0;position:relative;"><div class="wistia_responsive_wrapper" style="height:100%;left:0;position:absolute;top:0;width:100%;"><div class="wistia_embed wistia_async_h5fqhdgsep videoFoam=true" style="height:100%;position:relative;width:100%">&nbsp;</div></div></div>
<br>

## Introducing Auth0 Signals Community Version

Today we are introducing a standalone community version of part of the signals we use in our pipeline. More specifically, the **IP reputation signal**. This comes from our acquisition of Apility.io and provides a continually curated and accurate IP, email, and domain reputation data. It takes the hard work out of consuming Open-Source Intelligence (OSINT) by curating, parsing, and normalizing numerous blacklists from across the dark web. We use this data to protect our own infrastructure.

![DIAGRAM](https://images.ctfassets.net/23aumh6u8s0i/5hDiy0cE8lezc61zjwTGnt/168830a9782a26dc67f38d74db746504/diagram-blacklist)

## Why Did We Build Auth0 Signals?

Auth0 Signals and anomaly detection are the foundation of developing a robust adaptive authentication system, ultimately enhancing our continuous authentication capabilities. The goal of adaptive authentication is to continually adapt to a changing threat landscape instead of using a simple rules-based system to block specific interactions.

For example, simple brute force protection usually relies on blocking high-velocity requests above a certain threshold, such as 100 authentication attempts per minute for a single IP address. The problem with this approach is threat actors can create scripts to identify this threshold and then adapt their botnet to operate below it. Effective adaptive authentication takes other risk signals into account, such as IP reputation data.

One of the most pressing threats Auth0 Signals will help address is [credential stuffing attacks](https://auth0.com/blog/what-is-credential-stuffing/). In credential stuffing attacks, threat actors use stolen credentials from one breach to break into users' other accounts. [This is effective because 65% of people reuse passwords across multiple accounts, according to Google](https://www.forbes.com/sites/daveywinder/2019/02/05/google-reveals-a-big-problem-with-passwords-on-safer-internet-day/#297a05f85e0b). Even the largest companies are vulnerable if they don't have the right preventative measures in place.

As a central authentication service that processes billions of logins per month, we are in a good position to observe trends in credential stuffing attacks targeting our customers' identity implementations. [On some days, these attacks originate from more than 50,000 IP addresses and may account for as much as half of all login attempts using our platform](https://auth0.com/resources/whitepapers/credential-stuffing-attacks).

Auth0 Signals, coupled with the Anomaly Detection Engine, will detect these attacks with a high degree of efficacy early in the authentication pipeline. IP addresses identified as participating in a credential stuffing attack will be forced to solve a CAPTCHA, which addresses the vast majority of these attacks.

## Try the API Now. It's Free!

Auth0 IP Signals will assist security analysts with incident response and forensic investigations, as well as provide application security engineers with proactive abuse prevention accessed via an API.

<script src="https://fast.wistia.com/embed/medias/v6ilxd3jhu.jsonp" async></script><script src="https://fast.wistia.com/assets/external/E-v1.js" async></script><div class="wistia_responsive_padding" style="padding:60.83% 0 0 0;position:relative;"><div class="wistia_responsive_wrapper" style="height:100%;left:0;position:absolute;top:0;width:100%;"><div class="wistia_embed wistia_async_v6ilxd3jhu videoFoam=true" style="height:100%;position:relative;width:100%">&nbsp;</div></div></div>
 <br>
 
### Incident response and forensics 

When a security incident is identified, security analysts begin investigation and response processes to determine if a legitimate security incident occurred, the scope of the incident, and the best way to remediate the threat.

Using the _Auth0 IP Signals_ tool, security analysts can submit IP addresses involved in such incidents to quickly identify traffic from known threat sources.

### Abuse prevention

Using _Auth0 IP Signals API_, security professionals can detect malicious activity proactively, not reactively. For example, automatically checking IP reputation during the authentication flow can help prevent common threats, such as credential stuffing attacks.

## Final Thoughts

Last year, I wrote about [our vision for our identity platform](https://auth0.com/blog/the-developer-first-identity-platform-auth0-story-and-future/) and how we want to help security professionals by providing them with a single pane of glass that alerts them and self-remediates any sort of identity attack. This is a step towards fulfilling that vision. I am very excited about what's coming this year to help you all making your applications safer.

**To try out Auth0 IP Signals, our first free Signals API, visit [auth0.com/signals/ip](https://auth0.com/signals/ip)**


New Ways to Combat Automated Attacks: Auth0 Signals

kaycie-east

As PR Manager, Kaycie supports public relations and global communications efforts for Auth0 in the AMER region. When not promoting the Auth0 brand, Kaycie can be found hiking, traveling, or searching for the next best bite to eat.

PR Manager, AMER Region

Kaycie East

Forbes and Statista recognize Auth0 as a leader in the security industry, and for its reputation, employee satisfaction, and company growth



**BELLEVUE, Wash. – March 10, 2020 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced it was named to Forbes’ inaugural [‘America’s Best Startup Employers for 2020’ list](https://www.forbes.com/americas-best-startup-employers/#38e7a3696527), ranking 51st out of 500 companies listed. This prestigious award presented by Forbes, a global media company, and Statista Inc., the world-leading statistics portal and industry ranking provider, recognized Auth0 as one of the best startup employers across various industries, and one of the top three security companies for 2020.

Forbes and Statista analyzed more than seven million data points gathered in Q4 2019 through comprehensive research and social listening to identify the top 500 startup employers in the U.S., based on employer reputation, employee satisfaction, and company growth. The numerous key performance indicators that comprised these three areas of measurement were then combined to analyze which best-performing startups made the list. While more than 10,000 companies were initially considered for the recognition, 2,500 companies qualified for in-depth analysis, and only 500 companies, including Auth0 – along with companies like Duolingo, Allbirds, Gitlab, Udemy, and Chime – were identified for their renowned dynamism and innovative drive.

“Forbes partnered with market research company Statista to identify the top employers in the startup arena,” said Doug Lopenzina, VP Content Licensing and Syndication of Forbes Media LLC. “Just 500 are being recognized. We are thrilled to spotlight these companies for their collective excellence as employers.”

“We are a company that is passionately dedicated to our culture. We want to be a place that people truly enjoy working in – a place where meaningful contributions happen. It is a great honor to be recognized as one of the best startup employers in the U.S. for 2020,” said Eugenio Pace, CEO and co-founder of Auth0. “Our placement is a reflection of the trust and confidence our team and customers have instilled in us since day one. We will continue to innovate and invest in a work environment that centers around collaboration, communication, and culture.”

Earlier this year, Auth0 [announced](https://auth0.com/blog/auth0-closes-most-impactful-year-yet/) another successful year of business, ending 2019 with a 70 percent increase in overall revenue and customer acquisition, and a 35 percent expansion of its workforce. Along with its consistent and impressive year-over-year growth since its inception in 2013, Auth0 continues to be recognized as a leading identity management and security provider and for its workplace culture in respected industry awards, including [Deloitte’s Technology Fast 500™](https://www2.deloitte.com/us/en/pages/technology-media-and-telecommunications/topics/north-america-technology-fast-500.html), [Inc. Magazine’s Best Workplaces 2019](https://auth0.com/blog/auth0-recognized-as-one-of-inc-magazines-best-workplaces-2019/), [Forbes Cloud 100](https://auth0.com/blog/auth0-is-named-to-the-forbes-2019-cloud-100/), [Built In Seattle’s list of ‘Best Places to Work in 2020'](https://www.builtinseattle.com/companies/best-places-to-work-seattle-2020), and the [G2 Winter 2020 Grid® Report](https://auth0.com/blog/auth0-named-a-leader-in-the-g2-winter-2020/).

<include src="asides/AboutAuth0" />

### Media Contacts
Kaycie East<br>
Auth0 Communications<br>
[press@auth0.com](mailto:press@auth0.com)<br>
 
Hannah Carroll<br>
Matter for Auth0<br>
[auth0@matternow.com](mailto:auth0@matternow.com)<br>


Auth0 Named One of Forbes America's Best Startup Employers for 2020

jenny-obrien

I'm a former business journalist who's fascinated by the intersection of tech and business strategy — in particular how the right solution can transform an idea into reality. I specialize in ROI, data privacy, and identity.

Business Content Manager

Jenny O'Brien

Your company’s value lies in its data. Here’s how to get it M&A-ready.


For executives, positioning your business for mergers and acquisitions is a bit like searching for a spouse: Ideally, two organizations join together in a binding relationship to create something that is greater than the sum of its parts. But just as most first dates don’t lead to marriage, most Merger and Acquisition (M&A) deals fall apart before they ever take place.

Often, due diligence reveals that one company’s internal operations are in disarray, and the dealmakers get cold feet. Even if the deal does go through, [research shows](https://hbr.org/2016/05/so-many-ma-deals-fail-because-companies-overlook-this-simple-strategy) that the majority of completed M&As end up coming at a loss to shareholder value.

If you’re looking to put together a successful M&A deal, you need to prove from the outset that you can integrate your operations with a new partner quickly, easily, and securely. That requires putting identity and access management (IAM) at the center of your M&A strategy.

## IAM Integration Shouldn’t Slow Down Your M&A

When the ink is dry on your M&A deal, you want to hit the ground running and capitalize on synergies, locate economies of scale, and break into new markets. But part of a merger is the merging of data, allowing you to benefit from each other’s workforces, infrastructure, and market share. If your IAM solutions don’t integrate, you can wind up with duplicate processes, wasted resources, and team members who can’t access the information they need under the new structure.

Trying to handle post-merger integration is a challenge for most in-house developers because coding for identity is a specialized and constantly evolving field. If your IAM solutions aren’t compatible, [it can easily take months](https://auth0.com/learn/servcorp-saves-months-development-time-thanks-auth0/) to integrate applications, and that’s time that internal teams should spend on value creation.

A successful M&A deal has hundreds of moving parts — from consolidating your supply chains to picking out a new logo — and, inevitably, getting both parties in line takes time. But during the onboarding period, employees still need to be able to go ahead with business.

<include src="TweetQuote" quoteText="Change is a huge part of post-merger integration. Find out how @auth0’s IAM solution is central to your M&A strategy."/>

Kurt Borg, senior product owner of Auth0 customer [Catena Media](https://auth0.com/case-studies/catena-media/), has discussed the challenge of managing multiple teams during acquisitions: “We had a lot of systems that people used to log into with different accounts,” Borg says. “That is a nightmare to maintain and it’s a nightmare for scalability because new people join and need access... And when people leave that is the most delicate thing because you need to make sure that all access is closed. If you don’t have one centralized authentication system, there’s going to be a problem.”

Controlling permissions across multiple systems requires an extensible IAM solution so administrators can manage disparate applications from a single location. Auth0’s platform connects to any application running on any platform or device, with detailed, step-by-step instructions so your developers can integrate across organizations as quickly as possible. That way, legacy applications aren't holding you back from locating cost synergies and embracing new technologies.

![Dashboard](https://images.ctfassets.net/23aumh6u8s0i/6NsvZr7ypj7N9Hbve61ObJ/14bb6abb55f40e92ff777a0f576cf980/IAM-dashboard)

## Mergers & Acquisitions Don’t Have to Compromise Customer Experience

Whether your business model is B2B or CIAM, the last thing you want to do is frustrate your customers with M&A disruptions, since every time you lose a customer, your M&A deal loses value. That’s why it’s vital to provide a seamless customer experience during the transition, even while you’re consolidating operations behind the scenes.

A modern IAM platform can enhance customer experience by providing frictionless [access across multiple brands](https://auth0.com/blog/how-enterprise-architects-can-cut-manteinance-costs-in-multi-brand-media/). Implementing [Single Sign On (SSO) Authentication](https://auth0.com/learn/how-to-implement-single-sign-on/) allows users to log in to one application and then gain access to all of a parent company’s business units without needing to sign in again. Not only does this benefit customer experience, but it’s also the first step in creating a single, unified view of your customer, rather than the same person logging in with multiple sets of credentials. Consolidating customer directories during M&As can take significant time, but with a federated approach to identity, you don’t have to wait to start creating a centralized repository of customer information to act as a single source of truth.

<include src="TweetQuote" quoteText="Discover how #identitymanagement can help reduce the scalability nightmares during acquisition-driven expansions by streamlining post-merger integration."/>

Ensuring customer satisfaction during an M&A isn’t just about improving their login experience, and your most important customer-facing touchpoints are your employees. Those employees can’t assist customers if the data they need is siloed, or if they’re struggling to navigate unfamiliar tech. But with a modern, centralized IAM platform, employees from across both organizations can access a complete profile of a customer and their needs while they're speaking, enabling them to offer the right assistance and products. Being able to offer IAM as a competitive advantage can increase the purchase price of an acquired company.

## Data Security Can Be an M&A Liability… or an Asset

If data security was once an afterthought in M&A transactions, it’s now a make-or-break factor. Today, companies must contend with a new wave of global data privacy laws like [GDPR and CCPA](https://auth0.com/blog/data-privacy-2019-the-lowdown/), which can impose debilitating fines for noncompliance.

Case in point: [Marriott International](https://www.csoonline.com/article/3441220/marriott-data-breach-faq-how-did-it-happen-and-what-was-the-impact.html) was hit with a $123 million [GDPR fine](https://www.forbes.com/sites/kateoflahertyuk/2019/07/09/marriott-faces-gdpr-fine-of-123-million/#2c71c1484525) for a data breach that came as the direct result of IT problems with their acquisition of Starwood. Starwood’s network was compromised in 2014, Marriott acquired them in 2016, and in 2018, when the breach came to light, Starwood’s reservation system still hadn’t been migrated to Marriott’s system. The breach, and its fallout, has become a cautionary tale about the importance of data security due diligence in M&A deals.

Achieving compliance in a rapidly evolving regulatory landscape requires expertise and constant, ongoing maintenance, so a legacy, in-house IAM solution may have security or compliance gaps. Some SMBs may be too small to fall under CCPA or GDPR’s scope, but it should still be part of your growth strategy. Even if you’re confident your system is airtight, an M&A deal could fall through if your prospective acquirer is nervous that they’ll be inheriting unresolved issues.

To give potential M&A partners peace of mind that there are no skeletons in your data security closet, you first have to form a complete picture of where your data is being stored and who has access to it. Unfortunately, most businesses have sensitive information siloed across business units, shared via unsecured applications, or access to vendors or ex-employees. But if you connect your applications to a centralized user management system, you can impose order on your data.

![Auth0 Dashboard](https://images.ctfassets.net/23aumh6u8s0i/4jTBX21IwfoVe0hK9Jys4D/7bfcdf1a6525ef6a115dafcd8576402e/auth0-dashboard)

With a dashboard for user management, you can see how your data is being used, manage permissions, and implement heightened security as needed. For example, if there were a spreadsheet of unencrypted customer data, you could see who had access via your dashboard. From there, you could decide that it would be an appropriate place to implement [multifactor authentication (MFA)](https://auth0.com/blog/why-nist-recommends-mfa-to-fight-ecommerce-fraud/), so your employees would have to prove their identities before accessing it.

The simplest solution for proving your data security bona fides is to outsource IAM to a trusted, credentialed IAM platforms like Auth0, whose core competency is data security and compliance. Not only will the right IAM partner provide the appropriate security updates, but it will also lend you its credibility, and your prospective partners will feel more comfortable sharing their data with you.

## Give Your Company M&A Appeal

2018 and 2019 were banner years for M&A activity, and the [trend will likely continue](https://www2.deloitte.com/us/en/pages/mergers-and-acquisitions/articles/ma-trends-report.html) in 2020. Executives who want to capitalize on this moment have to be able to prove that their partners will be getting data that is streamlined, accessible, and secure, not a tangled legacy application stamped with the idiosyncrasies of in-house developers. With an extensible IAM platform like Auth0, you can position your company for successful deals—not just in getting them signed but in getting them to deliver real shareholder value as well.

<include src="asides/AboutAuth0" />


Why Your M&A Strategy Has to Include an IAM Solution

2019 highlighted by $103M funding round and global growth


**BELLEVUE, Wash. – January 28, 2020 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced another successful year of business, ending 2019 with a 70 percent increase in overall revenue and customer acquisition, including record-breaking sales in Q4. Under the direction of Eugenio Pace, CEO, and co-founder, the company achieved a consecutive year of high double-digit growth and continues consistent year-over-year growth since its inception in 2013. 

Auth0 celebrated many highlights in 2019, most notably, a $103 million round of [Series E funding](https://auth0.com/blog/auth0-closes-103m-in-funding-passes-1b-valuation/), propelling Auth0 into “unicorn status” with a $1 billion valuation. 

Forrester predicts that the IAM software market will grow to $16.8 billion by 2023. This unceasing demand for customizable identity management was made clear by Auth0's high-velocity growth, including remarkable regional expansion in [EMEA and Asia-Pacific (prompting a new Auth0 office in Singapore)](https://auth0.com/blog/auth0-expands-european-presence-with-customers-in-belenux-and-nordics/); a global partner program that tripled its revenue and deeper integration with Amazon Web Services ([AWS](https://auth0.com/blog/auth0-joins-the-aws-partner-network-global-startup-program/)); and [key customer wins](https://auth0.com/customers).  

"When Matias Woloski and I started the company in 2013, this level of success and growth is something we only imagined in our wildest dreams,” said Pace. “Our differentiated identity platform and its adoption across all market sectors have given us the opportunity to build our team to more than 600 employees, open six offices, and work with some of the biggest enterprises around the world. We are so grateful for the whole Auth0 team and our customers, and are looking ahead to another wildly successful year.” 

[Key appointments](https://auth0.com/blog/auth0-expands-c-suite-with-new-executive-appointments/) to the Auth0 leadership team, a 35 percent expansion of its workforce to 578 employees by the end of 2019, along with continued [analyst](https://auth0.com/blog/pr-auth0-named-a-visionary-in-gartner-2019-magic-quadrant/) and [press](https://auth0.com/press/) recognition of its industry leadership, made it a banner year for the company. 

Continuing milestone achievements in 2020, Auth0 eagerly anticipates its first customer and developer conference, [Auth0® Assemble – The Identity Conference for Application Builders™.](https://auth0.com/blog/auth0-assemble-is-the-identity-conference-for-application-builders/), The conference will take place in San Francisco on August 26-27, 2020, and will mark a historic event for the company this year.

<include src="asides/AboutAuth0" />

### Media Contacts:
Jeana Tahnk<br> 
Auth0 Global Communications<br>
[press@auth0.com](mailto:press@auth0.com) 
 
Alexandria Plew<br>
Matter for Auth0<br>
[auth0@matternow.com](mailto:auth0@matternow.com)


Auth0 Closes Most Impactful Year Yet

Calif. AG’s independent report released last weekend project a total initial compliance spend of $55 billion



Last weekend, the State of Calif. Attorney General released an [_independent report_](http://www.dof.ca.gov/Forecasting/Economics/Major_Regulations/Major_Regulations_Table/documents/CCPA_Regulations-SRIA-DOF.pdf) putting the estimated cost of [California Consumer Privacy Act (_CCPA_)](https://auth0.com/ccpa/) initial compliance for the world’s fifth-largest economy at [_$55 billion_](https://www.cnbc.com/2019/10/05/california-consumer-privacy-act-ccpa-could-cost-companies-55-billion.html). While much of the focus has been on larger companies like Google and Facebook, as Wired explained, the companies most likely to feel the sting aren’t operating at that scale. [_It’s the smaller companies that could take a larger percentage hit_](https://www.wired.com/story/why-californias-privacy-law-wont-hurt-facebook-or-google/)

![The smaller companies in California are most likely to feel the CCPA sting](https://images.ctfassets.net/23aumh6u8s0i/6nOzt9wsmyGnfsP6Z4DsdA/d71c4b8dc04f9b80daf6f5d05d25e72c/downtown-los-angeles-at-night)

## Which rights are granted?

[CCPA](https://auth0.com/ccpa/) builds on the state’s existing data privacy law, which has not kept up with the [evolving definition of Personal Information (PI)](https://auth0.com/resources/whitepapers/evolving-definition-of-personal-Information). The law affords consumers four key rights:

1. **Right to Know:** The right to be informed about how and why and when data is collected, what data or categories of data is collected, as well as the disclosure of use and sales of PI.
2. **Right to Delete:** The ability to request that businesses delete PI collected from the consumer and direct service providers to also delete (unless excepted).
3. **Right to Opt-Out:** Consumers can direct a business selling a consumer’s PI to stop. Minors from 13-16 may not have their PI sold without affirmative authorization. Under 13, that authorization must come from a parent or legal guardian.
4. **Right to Non-Discrimination:** No business may discriminate against a consumer for exercising any of these rights. They can’t deny goods or services, charge different prices or provide a different level or quality of service. But, a business can offer different rates or service if the value is reasonably related to the consumer’s data.

With 6 amendments waiting for a signature from the governor of the State of California by Oct. 13, 2019, the law is expected to go into effect on Jan. 1, 2020 with enforcement beginning on July 1, 2020. 

For those who remember the onset of EU’s data privacy regulation, GDPR (General Data Privacy Regulation), this may sound similarly stressful, but if you’re already GDPR compliant, you are part way there. Still, this is an untested law with some admittedly fuzzy language. How strictly it will be enforced remains to be seen. Based on the AG’s recent report, here’s what companies can expect in terms of cost.



## 4 categories of cost

The AG’s report outlines four main costs. As we saw with CCPA, thinking through the full impact of the law will require legal costs [_if you fall within the requirements_](https://auth0.com/explore/data-privacy/) and could include rethinking your business model.

1. **Legal costs:** You’ll need an attorney to evaluate your technical and business plans. No matter what you read online, your best source is the legal consultant you pay to interpret the law regarding your specific situation. 
2. **Operational:** You’ll need to establish some non-technical infrastructure and procedures for handling compliance.
3. **Technical:** Establishing the technologies to handle requests from large numbers of consumers and for things like establishing an [opt-out button on your home page](https://www.jdsupra.com/legalnews/the-ccpa-has-placed-a-mandatory-link-on-61019/) if you sell PI.
4. **Business:** The law may impact your business model or require renegotiations with service providers.

## Back of the napkin costs

So total compliance cost is going to vary. How much? The AG’s report expects that 75% of all California businesses will be expected to comply, with the total cost of efforts coming in at approximately $55 billion collectively, which is 1.8% of California’s 2018 Gross State Product.


![Back of the napkin costs](https://images.ctfassets.net/23aumh6u8s0i/6GpHGCRbM7AJlMje9mVpBZ/ed454437152884777d738933ca72947c/back-of-the-napking-costs)

*Source: *[*_Standardized Regulatory Impact Assessment: California Consumer Privacy Act of 2018 Regulations_*](http://www.dof.ca.gov/Forecasting/Economics/Major_Regulations/Major_Regulations_Table/documents/CCPA_Regulations-SRIA-DOF.pdf)* *


Also important is that 83% of California’s businesses will be able to leverage their GDPR compliance. The laws aren’t perfectly aligned, which is why we are seeing [_CEOs like Apple’s Tim Cook and Satya Nadella call for a global data privacy law_](https://www.businessinsider.com/satya-nadella-on-gdpr-2019-1).

<include src="TweetQuote" quoteText="Back of the napkin estimates of how much your company might need to spend to become #CCPA compliant."/>


## Future-proofing

Compliance isn’t a one-and-done activity. It requires regular maintenance and monitoring, which will vary according to business model and company size. While the rapidly evolving data privacy landscape can seem daunting. Having gone through GDPR compliance, many Auth0 customers tell us that identity can be a good place to begin to [_properly clarify what data they need to retain to give their customer’s the experiences they expect_](https://auth0.com/explore/data-privacy/). If you’d like to learn more about how Auth0 can help you move towards CCPA identity compliance, reach out to [_an Auth0 expert_](mailto:%20sales@auth0.com).

![View of Bay Bridge and San Francisco from Treasure Island California](https://images.ctfassets.net/23aumh6u8s0i/1GtfAs85Q7o2WxEOXnhIhW/5177191cb38ed3a34a2530e67841e2c7/view-bay-bridge-san-francisco-from-treasure-island-california)

<include src="TweetQuote" quoteText="The State of Calif. AG estimates initial CCPA compliance costs at $55B. Find out what your company can expect to spend."/>

<include src="asides/AboutAuth0" />


How Much Will CCPA Cost Your Company?

Private program reinforces company’s strong security ethos


**BELLEVUE, Wash., Oct. 1, 2019** -- [Auth0](https://auth0.com/), a global leader in Identity-as-a-Service (IDaaS), today announced the launch of a private bug bounty program to further reinforce its emphasis on security and ensure that its customers are protected from any vulnerabilities.

The private bug bounty is a specialized program that will allow Auth0's security team to partner with selected researchers to source potential vulnerability discoveries in exchange for monetary rewards. The bug bounty will be run on [Bugcrowd](https://www.bugcrowd.com/) and will expand the company's current [Responsible Disclosure Program](https://auth0.com/responsible-disclosure-policy/), which is already in place.

"We take the privacy and protection of our customers' data very seriously and are dedicated to investing the time and resources into ensuring we adhere to the highest standards," said Joan Pepin, CISO and VP of Operations at Auth0. "Our security program is maturing rapidly, and the launch of this bug bounty program reinforces our dedication to our customers and the highest level of security we offer them."

Bugcrowd will select and invite security researchers registered on its platform based on skills and experience. Each report verified by Bugcrowd's Application Security Engineer team will be then sent to the Auth0 Product Security team to assess the severity of the finding, assign the researcher a monetary reward, move the issue to its internal vulnerability database, and work with relevant Product and Engineering teams towards remediation.

"Bugcrowd deploys a global Crowd of diverse, creative, and highly-skilled security researchers to identify and solve security challenges," said Ashish Gupta, CEO at Bugcrowd. "The result is our ability to provide highly specialized security expertise to the high caliber of companies we work with. We are really excited to be supporting the launch of Auth0's Bug Bounty Program and serve as an extension of its security team."

The program is launching with approximately 25 global researchers who have been identified and invited by Bugcrowd, and will increase in number later this year.

Auth0 is a trusted security partner to its customers and has achieved certification for many important compliance regulations, including HIPAA, SOC 2 Type II, ISO 27001, ISO27018, and more. Please visit [Auth0 Security](https://auth0.com/security/) for more information.

<include src="asides/AboutAuth0" />

### Media Contacts

Jeana Tahnk<br>
Corporate Communications<br>
Auth0<br>
[jeana.tahnk@auth0.com](mailto:jeana.tahnk@auth0.com)

Meghan Gardner<br>
Matter for Auth0<br>
[auth0@matternow.com](mailto:auth0@matternow.com)


Auth0 Launches Bug Bounty Program

Chief Financial Officer and Chief Product Officer join company to support hypergrowth


**BELLEVUE, Wash., Sept. 17, 2019 —** [Auth0](https://auth0.com/), a global leader in Identity-as-a-Service (IDaaS), today announced Barry Plaga as chief financial officer (CFO) and Shiven Ramji as chief product officer (CPO), two key appointments to the senior leadership team.

[Plaga](https://www.linkedin.com/in/barry-plaga-97204b14/) joins Auth0 as a seasoned CFO with more than two decades of experience overseeing financial and operational functions. Previously, Plaga served as the CFO and COO of Guidance Software, where he oversaw the financial planning, accounting, and treasury functions of the company worldwide, as well as managing investor relations, IT, legal, and operations.

As CPO, [Ramji](https://www.linkedin.com/in/shivenramji) will guide Auth0's product vision, innovation, design, and strategy, and brings more than 15 years of experience in B2B and B2C product management, and business development. Before joining Auth0, Ramji served as the SVP of Product at DigitalOcean, where he led the strategy of DigitalOcean's products, pricing, and partnerships.

"Barry and Shiven bring incredibly deep experience and a proven history of taking fast-growing technology companies to the next level," said Auth0 CEO and co-founder Eugenio Pace. "We are very excited to welcome them to the team, and will leverage their collective expertise to propel Auth0 through its next phase of growth."

<include src="asides/AboutAuth0" />

### Media Contacts

Jeana Tahnk<br>
Corporate Communications<br>
Auth0<br>
[jeana.tahnk@auth0.com](mailto:jeana.tahnk@auth0.com)

Meghan Gardner<br>
Matter for Auth0<br>
[auth0@matternow.com](mailto:auth0@matternow.com)


Auth0 Expands C-Suite with New Executive Appointments

A company retrospective and future vision from Auth0’s CTO and Co-Founder.



Last week we had our annual offsite in Cabo, Mexico where we shared with all the Auziros where we come from and where we are going with our product. Yesterday, we [announced our new funding](https://auth0.com/blog/auth0-closes-103m-in-funding-passes-1b-valuation/) and I wanted to share some of the same things we talked about last week.

<include src="TweetQuote" quoteText="A company retrospective and future vision from Auth0’s CTO and Co-Founder @woloski"/>

## The Beginning

When we started Auth0 in 2013, there were three important shifts developers were going through related to authentication and authorization:

1. Identity becoming the ultimate firewall with software deployed in the cloud and widespread smartphone usage, and consequently, richer API emergence

2. Developers picking best-of-breed platform and languages

3. Password and data breaches becoming a much more prevalent threat 

Suddenly, implementing your own authentication and authorization layer was not a great idea. Developers were confronted with software deployed anywhere; the user identity flowing throughout multiple services written in different languages/platforms; and the need to implement best security practices to prevent a breach.

## Developer-First, Simple, and Extensible

Given the challenges inherent to building authentication and authorization, our strategy for the first few years was to build a platform for developers that would provide a simplified layer on top of this complexity. At the same time, when we started serving our first enterprise customers, we had to deal with last-mile integration issues and the need to customize the platform for their specific requirements. That was the driver to implement Webtask, our serverless runtime that provides built-in extensibility, in 2014 (even before AWS Lambda was a thing).

![Auth0 first strategy was to build a developer-first identity management solution.](https://images.ctfassets.net/23aumh6u8s0i/4W7Vw30Gsgjo1355FYo0ql/509d30f885700cbf858adcff6f32e7ce/developer-first-simples-and-extensible)

Our very first homepage had a clear message about making identity simpler for developers.

![Auth0 makes clear that one of its goals is to make identity simpler for developers.](https://images.ctfassets.net/23aumh6u8s0i/4RuNdazcERtfTw4or0eu85/6c722eeb8885af6af361697148647b3a/identity-made-simple-for-developers)

We spent a great deal of time building our resources and documentation for developers, not only for Auth0-specific usage but for identity topics in general. We found that there was a huge gap in knowledge, especially with the pace at which cloud computing was evolving, and the need for identity was increasing exponentially. We genuinely wanted to help developers. 

After six years and thousands of articles, quickstarts, and guides, our blog is now read by more than 700,000 developers monthly around the world. From this number, 17,000 of them sign up for a trial every month.

![After six years, Auth0's blog is now read by more than 700,000 developers monthly.](https://images.ctfassets.net/23aumh6u8s0i/4e79DMnoySjkThE4LpSWiU/8ec489eb763eb597980b099430a7768b/700000-developers)

As we have dedicated the last six years to also continually improving our identity platform, one constant has been keeping it developer-centric and relying on our proprietary extensibility capabilities to service our customers’ every identity need. It is this simple, yet powerful, last-mile customization capability that makes us stand out. And it’s evident that our customers take advantage of it, with almost *87% of them extending our platform* using serverless [rules](https://auth0.com/docs/rules) to achieve pretty much any use case you can think of.

![87% of Auth0's customers extend the platform by using serverless rules.](https://images.ctfassets.net/23aumh6u8s0i/2ewezukUfH9V5ev9cZzDYd/e7a557d16b8ce18cdc7d440df93427e5/87-percent-of-auth0s-customer-extend-the-platform)

## Scale, Trust, and Enterprise Readiness

When we raised our [Series A in 2015](https://auth0.com/blog/another-big-milestone/), we knew we had found our product market fit. We started to see more and more traction in the enterprise and were turning into a "real" company. With more enterprise customers needing our services and signing on as customers, we had to scale our product and organization.

Our focus then turned to scalability, trust and compliance, and enterprise readiness:

![Auth0 is also focused on scalability, trustworthiness, and enterprises.](https://images.ctfassets.net/23aumh6u8s0i/3LiWhgKqDmgAWiwh2KLxfg/d8154a6ae0a74e00782408768f2515e7/scalable-trustworthy-and-enterprise-readiness)

Midway 2019, Auth0 is a world-class platform that helps developers, administrators and end users to do their job simply and effectively, while offering unparalleled extensibility at every stage of the authentication and authorization lifecycle.

![Inside the Auth0 engine](https://images.ctfassets.net/23aumh6u8s0i/7Hjjueo0hs8FVorgfHytTi/b7620e17df28df15cd2f66c71365316d/inside-the-auth0-engine-low-res)

[Download the high resolution image here](https://cdn.auth0.com/blog/auth0-raises-100m-to-fuel-the-growth/inside-the-auth0-engine-high-res.jpg)

On the scalability front, we’ve had to go from 300 logins per second to 3,000. Today, we handle 2.5 billion logins per month, and have tens of million users registered, securing hundreds of thousands of applications.

![Auth0 is currently handling 2.5 billion logins per month.](https://images.ctfassets.net/23aumh6u8s0i/5JcN6MNxhW5CCb6S9WCDUC/9ff45507ee29a08be4928e604eb75f71/2-point-5-billion-logins-per-month)

On trust and compliance, we’ve grown our Security and Compliance teams and have achieved important certifications, such as ISO 27001 and 270218, SOC 2 Type 2, HIPAA, and PCI.

![Auth0 achieve important certifications, such as ISO 27001 and 270218, SOC 2 Type 2, HIPAA and PCI.](https://images.ctfassets.net/23aumh6u8s0i/5bNX1VaqkT6F1k02tsSG9U/c607cadac61e75f6b5c00ae05312f82b/auth0-certifications)

We made our product enterprise-ready, providing our customers with management tools like our Account Center; developing our Professional Services teams to help customers with the most complex scenarios implement even quicker; we started partnering with System Integrators and other developer-led companies like Twilio, Sendgrid, AWS, and others. 

![Auth0 made the product enterprise-ready, providing customers management tools and partnering with system integrators.](https://images.ctfassets.net/23aumh6u8s0i/3WqAAUjyBoisXLmhlrcMRH/58f22ea6bebc0515b643272154a8dcb2/auth0-partners-and-services)

In these six years, we’ve created a new category: a developer-first identity platform that is simple to implement and easy to extend. On top of that, we scaled it and made it trustworthy. So, what comes next for us? 

## Our Vision

Since our inception, we’ve always believed in a single platform to solve all Identity and Access Management (IAM) requirements. We take a very different approach compared to what traditionally has been done in this industry. Developers, the "makers" of this new world, appreciate building blocks that are simple to integrate but that can adapt to different situations.

When we think about how our platform evolves, we want to take the simplicity and flexibility we’ve built for the developer to a new level. Providing end-to-end workflows for the different actors using our software:

![Auth0 focuses on different actors, like end users, security teams, and administrators and IT professionals.](https://images.ctfassets.net/23aumh6u8s0i/1S43nIErK2EYrEYKuB1SoD/08b241acac6544ea5c554bffb2a7bf1e/end-to-end-solution-to-different-personas)

- **End Users**: We are all end users of software on the internet. But many idiosyncrasies happen with authentication, mostly because developers are choosing between optimizing between user experience and security as a zero-sum game. We are creating a platform that unlocks this dependency allowing you to increase BOTH. Rather than forcing users to log into applications every single time they want to use them, we enable developers to improve the overall experience and keep customers secure at the same time. Previously, only large companies with extensive resources, with hundreds of dedicated engineers were able to achieve that perfect balance. We aim to democratize this and make it available to all developers in the world.

- **Security teams**: Every company is a software company, which makes hiring security experts more and more challenging. CISOs are looking for ways to automate their jobs as much as possible with the end goal of protecting users’ security and privacy. We want to provide them with a single pane of glass that alerts them and self-remediates any sort of attack.

- **Administrators and IT Professionals**: IT departments and business support comprise the backend of IAM. Their day consists of keeping all systems humming, often amidst a relentless barrage of inbound help desk tickets. They have to deal with things like getting audit logs for compliance, onboarding users to new applications, updating a SAML certificate that might have expired, assigning permissions to access an API, resetting the MFA of someone who lost their device, etc. Now, multiply that by the number of users and applications they have to deal with, and you can understand why it can be gruesome. We can decentralize and automate this work by providing out-of-the-box integrations and self-service tools to create an ecosystem where developers can easily implement those to reduce the resources and costs involved in fielding these requests.

We are building a single platform consisting of building blocks and out-of-the-box customizable experiences to solve use cases for all these people. Our vision is to **provide people with secure access to any application in one-click or less**.

<include src="TweetQuote" quoteText="Auth0's vision is to provide people with secure access to any application in one-click or less."/>

## Our Guiding Principles

The one thing that stays constant, as we deliver on this vision, is our guiding principles. Providing a developer-first, simple, and extensible platform, is what makes Auth0 unique. Those differentiators lay on top of two foundational principles that we developed over the years: our scalability and trustworthiness.

<AmpContent>
![Auth0 product pillars](https://images.ctfassets.net/23aumh6u8s0i/4Ix2H1Un4Xx554OT6ID7R9/166b92f3f94d19e39c3e645841d97f91/auth0s-story-and-future_auth0-product-pillars)

</AmpContent>

<NonAmpContent>

<script src="https://fast.wistia.com/embed/medias/psvyqnp9dx.jsonp" async></script><script src="https://fast.wistia.com/assets/external/E-v1.js" async></script><p><div class="wistia_responsive_padding" style="padding:75.0% 0 0 0;position:relative;"><div class="wistia_responsive_wrapper" style="height:100%;left:0;position:absolute;top:0;width:100%;"><div class="wistia_embed wistia_async_psvyqnp9dx videoFoam=true autoPlay=true endVideoBehavior=loop" style="height:100%;position:relative;width:100%"><div class="wistia_swatch" style="height:100%;left:0;opacity:0;overflow:hidden;position:absolute;top:0;transition:opacity 200ms;width:100%;"><img src="https://images.ctfassets.net/23aumh6u8s0i/7xBl2sBiAff9Mk3vHjsvMn/543966d15bf3155eb8c9c095d09eae3f/swatch" style="filter:blur(5px);height:100%;object-fit:contain;width:100%;" alt="" onload="this.parentNode.style.opacity=1;" /></div></div></div></div></p>

</NonAmpContent>

When we think about solutions to the jobs these people above have; when we are answering a question to a customer; when we write a blog post; the whole product think about _simplicity_, _extensibility_, _developer-first_, _scalability_, and _trustworthiness_. If we are not holding the bar high on these principles, we want you to keep us accountable.

## What’s Next

The new funding will give us more fuel that will be used to accelerate investment in all areas. To accomplish the vision we have, we will: grow our Product Engineering teams; continue to invest in our developer-led go-to-market strategy with our Marketing teams; continue to invest in our global expansion to sell our product everywhere; and continue to grow our security, trustworthiness, performance, and scalability practices. 

![What's next for Auth0 after this funding?](https://images.ctfassets.net/23aumh6u8s0i/2yCB5Bu68m5rh1ihfAGgLi/b2e0ef7fd286c93957d9b3e257abdbe3/103-investment)

We are so thrilled with the support we have experienced thus far. With continued growth and global expansion, our mission and reason for existing will remain unchanged – to help developers innovate faster.

If you identify yourself with our vision and mission (and our [culture](https://auth0.com/blog/our-culture-and-values-at-auth0/)), please, go ahead and [apply to join us](https://auth0.com/careers)!


The Developer-First Identity Platform – Auth0's Story and Future

df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing.<br/><br/> Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

We offer three tactics to create a more open and secure company — for your colleagues and end users.



->![Two people shaking hands in office environment](https://images.ctfassets.net/23aumh6u8s0i/2brFbaENwm1v0BO1alPzES/378e13d35486ac61232cdb192e0f3d15/shaking-hands)<-

[_Image via Pexels_](https://www.pexels.com/photo/achievement-adult-agreement-arms-1243521/)

Cybersecurity can be a black box. If you aren’t a software engineer, it’s almost impossible to figure out what’s happening behind the scenes to reduce threats and protect data.

And even if you are an expert, the multitude of changes, threats, and solutions can be dizzying.

None of this is helped by the fact that most companies choose to remain tight-lipped about what cybersecurity measures they have in place. In some ways, that makes sense: publicizing too much about your efforts could decrease your competitive edge and make you vulnerable to more attacks.

On the other hand, an intense level of secrecy about cybersecurity can be crippling. Knowledge-sharing throughout the industry is limited, and your customers can feel as though they’re left in the dark about what’s being done to protect their private information.

As a result, certain companies are opting to increase their transparency and disclose their cybersecurity practices. This piece will highlight the main drivers of change — and offer concrete solutions for business leaders to clarify their cybersecurity practices in a valuable manner.

## A Growing Push for Transparency

Pioneering regulations, as well as thoughtful business leaders, are catalyzing transparency initiatives. 

In February 2018, for example, the U.S. Securities and Exchange Commission [published an update](https://www.techrepublic.com/article/sec-will-now-require-us-companies-to-disclose-cybersecurity-risks-and-breaches/) to their 2011 cybersecurity statement. The update states that all publicly traded companies must "take all required actions to inform investors about material cybersecurity risks and incidents in a timely fashion." In addition, the National Conference of State Legislatures [reports](http://www.ncsl.org/research/telecommunications-and-information-technology/data-security-laws.aspx) that at least 24 different states have introduced laws related to the data security practices of private companies. 

In the UK, the [National Cyber Security Centre](https://www.irishtimes.com/topics/topics-7.1213540?article=true&tag_organisation=National+Cyber+Security+Centre) (NCSC) is pushing for [“more openness and demystification” around cybersecurity practices](https://www.irishtimes.com/business/technology/less-fear-and-more-transparency-key-to-fighting-cybercrime-1.3692135). This encompasses the work that the NCSC does with EU multinational companies.

For all companies that handle the data of EU citizens, regardless of their physical location, GDPR [requires](https://gdpr-info.eu/art-12-gdpr/) controllers to communicate about their data processing methods in “transparent, intelligible and easily accessible form, using clear and plain language.” 

Along with these external pressures, leaders within organizations are pushing for change. Microsoft’s Cybersecurity Field CTO Diana Kelley is [developing the company's Trust Center,](https://www.techrepublic.com/article/microsofts-security-tactics-focus-on-customers-transparency-and-working-with-its-tech-competitors/) which clearly articulates for customers how Microsoft uses and secures their information. Microsoft shares its progress on data security at an annual meetup with peers like IBM, Netflix, and Facebook.

As national and global regulations — as well as peer pressure — heat up, it's imperative for teams to have a plan in place for intelligently sharing their cybersecurity practices.

## 3 Ways You Can Increase Your Team's Transparency (and Bolster Your Security)

While a handful of teams are vocal and forthcoming about cybersecurity measures, it still isn’t second nature for many. Here are three ways to increase your own transparency and bridge those trust gaps inside and outside your organization. 

### 1. STRENGTHEN EMPLOYEE TRAINING.

->![Board meeting and presentation in office environment](https://images.ctfassets.net/23aumh6u8s0i/6LSX6AUWhE4xE1cr9L1vWw/40d3e18f90887e5f1a79339704b4e720/board-meeting)<-

[_Image via Pexels_](https://www.pexels.com/photo/group-of-people-sitting-near-table-1181396/)

Remember, not everybody within your organization is a cybersecurity expert. According to the [University of Phoenix](https://www.phoenix.edu/about_us/media-center/news/uopx-survey-perceptions-cybersecurity.html), just 10% of U.S. adults are familiar with common cybersecurity job titles (e.g., penetration tester or chief information security officer). 52% of the survey’s respondents had never even heard of the titles.

True transparency isn’t just about giving people information; it’s also about ensuring that they understand it. Internally, you need to invest in thorough training across all departments so that employees are fully aware of what to watch out for and how to protect themselves.

While your colleagues are your greatest assets, they can also be your biggest liabilities when it comes to cybersecurity. In 2018, a [Positive Technologies study](https://www.techrepublic.com/article/dont-skimp-on-it-security-training-27-of-employees-fall-prey-to-phishing-attacks/) of 3,332 employees found that 27% of participants clicked on test emails with phishing links. With the 2018 cost of a data breach on the rise — ticking in at [$3.68 million](https://www.ibm.com/security/data-breach) (up 6.4% from 2017) — it’s critical that everyone on your team recognizes threats and has resources to immediately report incidents.

### 2. DEVELOP A DETAILED PROCESS FOR HOW YOU'LL DISCLOSE BREACHES.

Nobody likes to dwell on cybersecurity incidents actually happening, but it’s essential that you have a process in place for how and when you’ll [disclose a breach](https://auth0.com/blog/what-is-a-data-breach/) if it does occur. Ironing out this process now allows you to be more proactive and move forward in a timely manner. In particular, if you handle the data of EU citizens, you have just 72 hours to report a breach, [according to GDPR's new deadline](https://gdpr-info.eu/art-33-gdpr/).

Timing can be a delicate balancing act. While you don’t want to act too quickly and disclose a breach before you have all of the necessary details, waiting too long to make the event known can expose you to criticism. Public trust in [T-Mobile](https://auth0.com/blog/3-critical-lessons-from-the-t-mobile-data-breach/), [Equifax](https://money.cnn.com/2017/09/08/technology/equifax-hack-disclosure/index.html), and [the German government](https://www.telegraph.co.uk/news/2019/01/04/hundreds-german-politicians-hacked-massive-data-leak/)(to name a few) declined following delayed disclosure of data exposures.

If you don’t already have clear protocols for disclosure, it’s time to create them. Consider including:

* A deadline for when internal and external stakeholders will be made aware of the event
* What information you will share with the different parties
* Incorporating language that empowers users to take security into their own hands

As we highlighted in our prior dissection of the [Reddit data breach](https://auth0.com/blog/what-companies-can-learn-from-the-reddit-data-breach/), you can return power to users who are in a situation where they feel like victims by laying out the steps they can take to protect their personal information.

->![Reddit Data Breach notice to users regarding 2FA and other security measures](https://images.ctfassets.net/23aumh6u8s0i/77n70IUdObd3KDLcqbQEWF/b120ee596c3faf6b6c914b6ae5fdac9d/reddit-data-breach)<-

[_Image Source: Reddit_](https://www.reddit.com/r/announcements/comments/93qnm5/we_had_a_security_incident_heres_what_you_need_to/?st=jkk18vb3&sh=ad92bacb)

While it might make you uneasy to be so upfront about your vulnerabilities, if you communicate the issue correctly, you can turn the risk into an asset by retaining and even bolstering user trust. 

### 3. IMPLEMENT A STRONGER USER MANAGEMENT SYSTEM.

One of the biggest barriers to transparency in corporate cybersecurity is that, even for IT staff, it can be difficult to understand who is working within their system. With a range of permissions granted to customers, employees, and third parties, such as consultants — it's easy to lose track of your users.

Implementing a system like [Auth0](https://auth0.com/) can help you keep all of your users at a given time in one central view. 

->![Auth0 Dashboard view](https://images.ctfassets.net/23aumh6u8s0i/01LwCh4Yy7Tk0LdhNxgxG8/7d2a6efdfb8b4c12093076b1e00b5140/auth0-dashboard)<-

Here, admins can monitor login activity, compare it with activity over time, and quickly note and take action on any unusual behaviors like multiple failed login attempts. Having a clear record improves your ability to demonstrate your practices both internally and externally.

## More Transparency Leads to Better Security

When talking about cybersecurity, it’s usually new technologies that get the majority of the spotlight. Yet simple fixes, like increasing your level of transparency, is are also fundamental to progress. If implemented correctly, transparency practices can lead to improved security and, as an added bonus, increased trust with your stakeholders. 

[Working with Auth0](https://auth0.com/) is one way that teams choose to boost their knowledge and ability to share information about cybersecurity. Auth0 is a trusted partner with thousands of enterprise customers across industries, giving teams and their end users added peace of mind in turbulent times.

<include src="asides/AboutAuth0" />


Cybersecurity Shouldn’t Be a Secret: Why Transparency Matters

Global demand for extensible identity management drives company-wide expansion



**BELLEVUE, Wash., – January 28, 2019 –** [Auth0](https://auth0.com/) a global leader in Identity-as-a-Service (IDaaS), today announced another successful year of business, ending 2018 with a nearly 80 percent increase in both sales and new customers. Under the leadership of CEO Eugenio Pace (also Co-founder), appointed to the position in December 2017, the company achieved a consecutive year of record growth.

Auth0 hit many milestones in 2018, including a [$60 million round](https://auth0.com/blog/auth0-announces-55m-series-d-funding/) of Series D funding, [expansion](https://auth0.com/blog/auth0-supports-global-growth/) of its Bellevue, London and Buenos Aires offices, a new [country manager](https://auth0.com/blog/auth0-announces-new-country-manager-in-japan/) for its Tokyo office, and [analyst recognition](https://auth0.com/blog/auth0-named-market-and-technology-leader-in-kuppingercole-leadership-compass-for-ciam/) of its industry leadership. These collective achievements represent the company's ongoing potential, as well as widespread acknowledgement of identity management as an integral technology.

The devastation of high-profile security breaches has prompted a universal call-to-action that will result in a projected $1 trillion spend on cybersecurity over the next five years ([Cybersecurity Ventures](https://cybersecurityventures.com/cybersecurity-market-report/)). This global demand for customizable identity management was made clear by Auth0's record growth in the U.S., EMEA, and APAC, as well as a global partner program that tripled its revenue.

"We are thrilled with the level of success we experienced in 2018, and are thankful for all customers who intrinsically trust our Universal Identity Platform for their identity management needs," said Eugenio Pace. "Of course, this would not have been possible without our entire team -- engineering, product, sales and partnerships, customer success, marketing, operations, and many more -- working hard behind the scenes to continue delivering the incredibly high-level of value and support our customers deserve."

To support this growth, Auth0 added 240 new employees last year, nearly doubling its team. Notable senior appointments were made, including Christian McCarrick, VP of Engineering, and Ghazi Masood, VP of Sales, Americas. The company will continue to grow its globally-distributed team in 2019 and adhere to its mission of a highly remote-friendly workforce, with a team now spanning 33 countries.

<include src="asides/AboutAuth0" />

## **Media Contacts:**
Jeana Tahnk<br/>
Corporate Communications<br/>
Auth0<br/>
[jeana.tahnk@auth0.com](mailto:jeana.tahnk@auth0.com)


Auth0 Closes Year of Impressive Growth in 2018

Reportedly more than 770M unique emails/passwords turned up on hacker site. Here’s how you can protect yourself and your company.

Talking about password breaches ends up sounding a lot like talking about a burglary. The hackers (thieves) get in, get your stuff, and make off with it to sell it (fence) on the black market. After we make a flurry of password changes we move on.  “It is quite a feat not to have had an email address or other personal information breached over the past decade,” Jake Moore, a cybersecurity expert at ESET UK, recently told [The Guardian](https://www.theguardian.com/technology/2019/jan/17/breached-data-largest-collection-ever-seen-email-password-hacking).

But while we’re returning to our busy lives, we’re forgetting that hackers are patient. [Collection #1](https://www.troyhunt.com/the-773-million-record-collection-1-data-reach/), reportedly the largest combination of breached password data ever posted to a hacking site illustrates that patience very clearly. 

<include src="TweetQuote" quoteText="Hackers offered 770M unique password/emails. How to protect yourself and your company from immediate breaches + social engineering attempts."/>

Hacker patience means that hacking is rarely a one-and-done invasion of your privacy. They’re piecing together data from larger and smaller hacks to put together as much of your digital identity as possible. 

The lone hacker in a hoodie is actually a hacker working on concert with a range of other hackers — sharing, buying and selling data that can be fed into automated attacks that would only be worthwhile with large data sets.

Troy Hunt, who runs [Have I Been Pwned](https://haveibeenpwned.com/) lays out the details:

* **2,692,818,238** rows of information
* **1,160,253,228** unique combinations of email addresses and passwords
* **772,904,991** unique email addresses

Based on identifying past personal email/password combinations, Hunt was able to state that the collection includes passwords that had been stored using [cryptographic hashing](https://auth0.com/blog/hashing-passwords-one-way-road-to-security/), but have been cracked. Hunt recommends storing passwords in a vault like [1Password](https://1password.com/) for security and ease.

<blockquote class="twitter-tweet" data-lang="en"><p lang="en" dir="ltr">Password managers are one of the few security constructs that actually make your life easier. Take logging onto a mobile app with <a href="https://twitter.com/1Password?ref_src=twsrc%5Etfw">@1Password</a> on iOS: tap the email field, choose the account, Face ID, login button, job done! Not a single character typed 😎 <a href="https://t.co/6ZKcGHfHhq">pic.twitter.com/6ZKcGHfHhq</a></p>&mdash; Troy Hunt (@troyhunt) <a href="https://twitter.com/troyhunt/status/1084386337359163392?ref_src=twsrc%5Etfw">January 13, 2019</a></blockquote>
<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>

As an individual, Hunt’s advice about switching to a [password manager](https://www.pcmag.com/article2/0,2817,2407168,00.asp) is echoed by Auth0’s CISO/VP of Operations Joan Pepin. “If you use the same key to secure every building on that block, when someone gets that key, the whole block is owned. And the compromise of one of those accounts equals the compromise of all the accounts. I have added over a thousand account passwords in my 1Password in six years. Mathematically, if each of them needs a new password, what else could I possibly do?”

Passwords are leaked all the time, [multi-factor authentication](https://auth0.com/learn/get-started-with-mfa/) (MFA) provides another layer of protection. Methods of MFA include using hardware and device-based authenticators. 

For companies looking to protect their users and servers from credential stuffing, a type of brute force attack, MFA and breached password detection, offered through Auth0, [can help ward off the attack](https://auth0.com/blog/credential-stuffing-is-a-persistent-threat-to-your-users/).

<include src="TweetQuote" quoteText="To a hacker, your digital identity is a like a jigsaw puzzle s/he has lots of time to solve. Tips on how to beat hacker patience from @CloudCISO_Joan and Security Operations Manager @Annyv2."/>

All of these suggested changes will provide additional layers of protection, but with all that data out there hackers may have also acquired personal information about your habits — like where you like to travel, eat, your personal priorities. This increases the likelihood that you could be a target for social phishing attacks, where the hacker uses personal information to get you to give over credentials that can allow them to control of your devices and/or access your accounts. Both individuals and companies have proven vulnerable to such attacks, which are expected to see [an AI-boost in 2019](https://techcrunch.com/2018/12/26/cyber-breaches-abound-in-2019/). Auth0 Security Operations Manager Annabel Villarroel offers some [additional protective strategies against social engineering](https://auth0.com/blog/achieving-security-awareness-through-social-engineering-attacks/).

If you’d like to learn more about how Auth0 can help protect your organization, reach out to [sales@auth0.com](mailto:sales@auth0.com).

<include src="asides/AboutAuth0" />

How to Beat Hacker Patience

Implement identity management tools for all of your users as you scale.



On August 21, Facebook took down over 600 accounts, pages, and groups that originated in Iran. These accounts were disseminating political disinformation, largely targeted at users in Latin America and the Middle East.

Cybersecurity firm FireEye initially tipped Facebook off about a network of pages called Liberty Front Press. Their reach was 74 Facebook pages, 70 accounts, and 3 groups, as well as 76 Instagram accounts.

The tip also led Facebook to discover an array of other networks, pages, and accounts that were disseminating false information — and engaging in cybersecurity attacks.

With these issues so widespread on the platform, how could Facebook not have figured it out sooner?

Coupled with numerous other [data breaches](https://auth0.com/blog/what-companies-can-learn-from-the-reddit-data-breach/) across multiple companies this year, the most recent Facebook incident highlights how important it is for companies to continually update their user-management practices as they scale — before bad activity gets out of control.

## Facebook's Disinformation Incident Reveals the Challenge of Monitoring All of Your Users

The number of daily active users on Facebook has nearly tripled since 2011. Today, it boasts 1.47 billion users worldwide.

![Facebook daily user statistics](https://images.ctfassets.net/23aumh6u8s0i/1A3WvCiIUCsatoS3Du1l7f/87c64d7a41a81547cc3261de519f27f3/facebook-scandal_daily-users)
 
In addition, as of Q2 2018, the company had over 25,000 employees, and it shares its data with numerous third parties. 

Although it recently ended this practice, following the [Cambridge Analytica scandal](https://auth0.com/blog/what-data-did-facebook-really-give-cambridge-analytica/), Facebook historically shared user information with major online and offline data brokers through its Partner Categories program. This included what the company had collected itself (e.g., page likes) and information from its advertisers.

<include src="TweetQuote" quoteText="With so many stakeholders accessing different parts of the Facebook platform at different times, it's clearly too much for Facebook to keep track of Fake news, and accounts are rampant."/>

These providers helped other businesses understand and optimize their marketing campaigns. As an example, [according to Facebook](https://www.facebook.com/help/494750870625830):

"An auto dealer may want to customize an offer to people who are likely to be in the market for a new car. The dealer also might want to send offers, like discounts for service, to customers that have purchased a car from them. To do this, the auto dealer works with a third-party company to identify and reach those customers with the right offer. The third-party partner provides Facebook with information that helps Facebook connect those customers with the offers." 

With so many stakeholders accessing different parts of the Facebook platform at different times, it's clearly too much for Facebook to keep track of [Fake news](https://www.zuora.com/2017/05/26/social-platforms-channel-fake-news-next-revolution-journalism-2/) and accounts are rampant.

How can your team do better?

## Avoid Your Own Disinformation Scandal with Strong Identity Management Tools

Even if you’re not as large as Facebook, there are key steps you can take as your company scales to be sure you are keeping track of who your users are (customers, employees, and third parties) and what behaviors they display in order to root out fake accounts and nefarious activities.

### Identity management for your employees

As your team expands on multiple levels, across new geographies and time zones, following everyone working within your system can be a headache.

Pushing certain [Rules](https://auth0.com/learn/cloud-identity-access-management/) in the cloud, like blocking people or even entire groups from logging in on particular devices or at certain times, can help cut down on inefficient DIY tactics and organize access in a streamlined way.

If using Auth0's solutions, you can quickly pull [user-profile details](https://auth0.com/docs/user-profile/user-profile-details), including

* first name and last name;
* email address; and
* specific company identifiers, such as an employee number or a listed department name.

Given the range of data sources that this information could come from, including custom databases, an Active Directory, or even a social provider like LinkedIn, Auth0 will normalize this and return a basic set of data, with attributes like  `user_id`, `name`, `nickname`, and `picture`, to allow admins and programs to retrieve the information they need when double-checking employees.

Giving admins the control to rapidly parse an employee user base will help them notice any suspicious behaviors — like repeated failed login attempts in real-time — mitigating the risk of false accounts or system breaches.

### Identity management tools for third parties

For third parties such as consultants or auditors (or, in Facebook's case, purchase-data providers like Datalogix, Epsilon, Acxiom, and BlueKai) that you allow into your system but that are not regular employees, providing them with a single sign-on (SSO) feature through [Auth0 Universal Login](https://auth0.com/universal-login) will not only make things cleaner and more efficient on their end but also help consolidate all of their credentials into a single location for vetting purposes.

Auth0 Universal Login provides a secure login infrastructure to authenticate users to your apps.

![Auth0 Universal login page](https://images.ctfassets.net/23aumh6u8s0i/6TwsXjuNeMnkg5I4ZN3y5o/c4b1c77a6e5b8e10b44dc000bde49d19/auth0-centralized-login)

On the back end, after the authentication event occurs, admins can call the `getUserInfo` method to acquire all of the user's profile information (as needed).

Keeping track of external users is critical in maintaining order and privacy within your system as needed (as Facebook's canceled Partner Categories program highlighted). Because these users aren't formal employees, you want to be sure that they still adhere to your company's standards and practices and aren't straying or creating unwanted programs.

### Customer identity management tools

Knowing your customers is key to growing your company. Strong customer-identity and customer-access tools can make onboarding quick and fun, up your daily active-user base, reduce churn, and [drive conversions](https://blog.nomnominsights.com/turning-customer-feedback-into-research-hypotheses/).

It also helps you ensure that no one is masquerading as someone they're not.

This year, British shipping company Clarksons revealed that a single fake account was to blame for [stealing confidential information](https://www.zdnet.com/article/clarkson-says-single-user-account-to-blame-for-data-breach/). The account accessed corporate databases and made off with highly sensitive data, such as Social Security numbers, criminal convictions, medical information, tax and insurance details, signatures, and login credentials  — along with even more personal details, like ethnicity and religion.

To get out of the mess, Clarksons had to hire outside forensic help to find and disable the problematic account.

Implementing social integrations can help you avoid this by immediately double-checking that all users are who they say they are. A social login feature relies on existing login information from a social network provider like Google to verify a users identity.

![Log into a Wordpress site using social login provider](https://images.ctfassets.net/23aumh6u8s0i/4DR1XvnUhTlC5oOYIQw4vU/c5c39ff1cd0ec9e4a6d26cb97ca860ed/facebook-scandal_auth0-wordpress)

A customer can sign into a third-party website like WordPress through Google instead of creating an entirely new account. Since the provider (Google) has already authenticated the user, it provides an extra layer of security.

Any further support you can get to vet users — even your loyal and trusted customers — can go a long way toward avoiding a costly data breach.

<include src="TweetQuote" quoteText="Creating or outsourcing tools like Auth0 Universal Login for rapidly pulling and storing current user data, and features like social login will help secure your company at its foundation so that you can grow."/>

## Use Identity Management Tools to Stop Bad Behavior at the Source 

As your company grows, it's a blessing to bring on more users — whether new customers, freelancers, consultants or employees. But it can quickly become a curse if you don't implement strong practices for monitoring them.

As the Facebook disinformation scandal clearly shows, without proper tracking, small issues can balloon out of control. Ideally, you'd stop any fake accounts at the login source so they don't snowball at all.

Creating or outsourcing tools like [Auth0 Universal Login](https://auth0.com/universal-login), [Rules for rapidly pulling and storing current user data](https://auth0.com/docs/rules/current), and features like [social login](https://auth0.com/learn/social-login/) will help secure your company at its foundation so that you can grow.


What the Facebook Disinformation Scandal Means for Your Company

How Auth0 is striving to keep its soul while hiring for dramatic growth

Building Company Culture for Scale

Rapid gaming industry growth across mobile, console, and PC platforms can lead to disaster without proper security and anti-fraud protections.



In April 2018, Epic Games’ [Fortnite generated $296 million](https://techcrunch.com/2018/05/25/fortnite-had-a-296-million-april/)—more than double what it generated in February. Growth was rapid across mobile, console, and PC platforms.

At the same time as users peaked in February 2018 with 3,400,000 simultaneous logins, [mysterious charges began to appear in users' accounts](https://kotaku.com/whats-really-going-on-with-all-those-hacked-fortnite-ac-1823965781), ranging from $99.99 to $149.99. Hackers made off with one-off charges and often racked up multiple thefts from single users. [One player even struggled to pay his rent](https://www.reddit.com/r/FORTnITE/comments/841zdn/account_hacked_epic_please_help_thats_my_rent/) as a result of the total financial damage. Thieves exposed critical data via multiple log-in attempts, posted sign-in codes, and offered upgrades at steep discounts.

The example isn't isolated. Annually, [cyber thieves make off with over 40 percent](https://www.panopticonlabs.com/our-technology/) of video-game publishers' in-game revenue. As the global [gaming industry's sales top $100 billion](https://seekingalpha.com/article/4184342-video-games-taking-will-esports-become-larger-sports), more criminals are taking notice, and more companies are at risk.

In 2018, it will be critical for gaming companies to know exactly who is logging into their system, when, how, and from where — in order to create a safe and productive environment that users trust and continue to visit.

## What Are Auth0 Rules? How Can They Help?

[Auth0 Rules](https://auth0.com/docs/rules/current) are short JavaScript functions that are executed each time a user authenticates to an application. For example, if you want to know what country a user is logging in from, you can pull this data with the [Add Country Rule](https://auth0.com/rules/add-country) in the Auth0 user dashboard. This can be helpful in locating individual hackers or clusters of them working closely together. In the case of Fortnite, several thefts corresponded to Russia.

While Auth0 has several Rules, all of which developers can use to customize and [extend Auth0's current suite of capabilities](https://auth0.com/b2c-customer-identity-management) to understand and protect end users, we've highlighted two particular ones below that growing video game companies can implement for better security as they scale.

These can be used separately or chained together for modular coding.

### User Fraud Score

The User Fraud score is particularly helpful in confirming that users are who they say they are and in quickly blocking those who are behaving inappropriately.

Auth0 has partnered with [Socure](https://www.socure.com/) to develop a user fraud score for each account that authenticates, based on their email address and IP address.

```javascript
function (user, context, callback) {
  // score fraudscore once (if it's already set, skip this)
  user.app_metadata = user.app_metadata || {};
  if (user.app_metadata.socure_fraudscore) return callback(null, user, context);

  if(!user.email) {
    // the profile doesn't have email so we can't query their api.
    return callback(null, user, context);
  }

  const request = require('request');

  // socurekey=A678hF8E323172B78E9&email=jdoe@acmeinc.com&ipaddress=1.2.3.4&mobilephone=%2B12015550157
  request({
    url: 'https://service.socure.com/api/1/EmailAuthScore',
    qs: {
      email:  user.email,
      socurekey: configuration.SOCURE_KEY,
      ipaddress: context.request.ip
    }
  }, function (err, resp, body) {
    if (err) return callback(null, user, context);
    if (resp.statusCode !== 200) return callback(null, user, context);
    const socure_response = JSON.parse(body);
    if (socure_response.status !== 'Ok') return callback(null, user, context);

    user.app_metadata = user.app_metadata || {};
    user.app_metadata.socure_fraudscore = socure_response.data.fraudscore;
    user.app_metadata.socure_confidence = socure_response.data.confidence;
    // "details":[
    //     "blacklisted":{
    //        "industry":"Banking and Finance",
    //        "reporteddate":"2014-07-02",
    //        "reason":"ChargeBack Fraud"
    //     }
    // ]
    user.app_metadata.socure_details = socure_response.data.details;

    auth0.users.updateAppMetadata(user.user_id, user.app_metadata)
      .then(function(){
        context.idToken['https://example.com/socure_fraudscore'] = user.app_metadata.socure_fraudscore;
        context.idToken['https://example.com/socure_confidence'] = user.app_metadata.socure_confidence;
        context.idToken['https://example.com/socure_details'] = user.app_metadata.socure_details;
        callback(null, user, context);
      })
      .catch(function(err){
        callback(null, user, context);
      });
  });
}
```

Socure incorporates information about individuals from social media, offline identity verification services, and publicly available data, to determine if an account is real or fake. While other vendors generally aggregate static points, such as a user's name, date of birth, and/or social security number, Socure + Auth0 focus on behavioral cues (e.g., how a user has transacted on other platforms, when, and from where; if they have a stable history; or if there are gaps and inconsistencies).

If a user has a high fraud score, you can put them on a watch list or require them to [provide additional information before they can transact](https://www.teampay.co/blog/finance-stack-startups/).

### minFraud (For Games with Payments)

In addition to rooting out suspect account logins and signups, minFraud helps secure your online marketplace by identifying possible fraud in online transactions.

The minFraud Rule will send the user’s IP address, email address, and username to MaxMind’s [minFraud API](https://dev.maxmind.com/minfraud/). Similar to the user fraud score, the API will return the risk score — but this time the focus is on the specific transaction (instead of the user as a whole).

```javascript
function (user, context, callback) {
  const querystring = require('querystring');
  const request = require('request');
  const crypto = require('crypto');

  const MINFRAUD_API = 'https://minfraud.maxmind.com/app/ccv2r';

  const data = {
    i: context.request.ip,
    user_agent: context.request.userAgent,
    license_key: configuration.MINFRAUD_LICENSE_KEY,
    emailMD5: user.email &&
        crypto.createHash('md5').update(user.email).digest("hex") || null,
    usernameMD5: user.username &&
        crypto.createHash('md5').update(user.username).digest("hex") || null
  };

  request.post(MINFRAUD_API, { form: data, timeout: 3000 }, (err, res, body) => {
    if (!err && res.statusCode === 200) {
      const result = querystring.parse(body, ';');

      console.log(`Fraud response: ${JSON.stringify(result, null, 2)}`);

      if (result.riskScore && (result.riskScore * 100) > 20) {
        return callback(new UnauthorizedError('Fraud prevention!'));
      }
    }

    if (err) {
      console.log(`Error while attempting fraud check: ${err.message}`);
    }
    if (res.statusCode !== 200) {
      const message = err && err.message;
      console.log(`Unexpected error while attempting fraud check: ${message}`);
    }

    // If the service is down, the request failed, or the result is OK just continue.
    return callback(null, user, context);
  });
}
```

MinFraud collects information from over [2 billion transactions](https://www.maxmind.com/en/minfraud-services) in its network. The tool assesses signs of fraud, such as

- suspicious pairings of user location with address and IIN data;
- risk associated with the IP address; and
- reputation checks for street addresses, email addresses, phone numbers, and devices.

In cases like _Fortnite_, minFraud could have helped the team block transactions that didn't meet standards for the above criteria, stopping theft from spreading throughout its network.

## Use Rules As Part of a Larger CIAM Strategy

Adding individual Rules that pertain to certain users on your platform is a step in the right direction. Setting up a comprehensive strategy for more deeply understanding all of your users is the next. Either [building or outsourcing](https://auth0.com/b2c-customer-identity-management) customer identity and access management solutions can bring a new dimension to your insights.

![Auth0 dashboard](https://images.ctfassets.net/23aumh6u8s0i/7sbXQ9SWpmPS7HuKh9pGhE/427d1c43629461957d5c506e8e9e535d/auth0-dashboard)

[Source](https://auth0.com/docs/getting-started/dashboard-overview)

With a well-crafted tool like a centralized dashboard (above), admins are afforded a bird's-eye view of all current and past activity. They can drill down into the granular details of each user, if need be, including when they joined the platform, their latest logins, and heaviest usage times. Admins can easily troubleshoot issues that arise by logging in as any user — or block access if they note multiple failed logins or excessive transactions.

As the threat landscape quickly evolves, particularly in fast-moving and highly technical spaces like gaming, coming up with solutions that are cutting edge and safe against the latest attacks can be enormously challenging — particularly for IT teams working 24/7 just to keep a game running. But taking time to consider and create a broad CIAM strategy, centered on end users, will make your game a safe space for competition for years to come.

<include src="asides/AboutAuth0" />


Secure Your Gaming Company With Auth0's Fraud Protection

saravana-kumar

Guest Author

Saravana Kumar

Learn how utilizing identity solutions like Auth0 allows your engineers to focus on what matters most to your company - developing your SaaS product's unique features.



<div class="alert alert-info alert-icon">
  <i class="icon-budicon-500"></i>
  <strong>Forrester Consulting analysis determines that using Auth0 can yield a 548% ROI and $3.7M in identity-related savings. Read the full report: <a href="https://resources.auth0.com/forrester-tei-research-case-study/">Total Economic Impact of Auth0</a>.</strong>
</div>

---

**TL;DR**: In this article, we will explore some of the key technical considerations you have to make while building highly-scalable SaaS products. The idea is to show that it's better to use reliable PaaS (Platform as a Service) vendors available in the market instead of utilizing your valuable engineering resources on infrastructure requirements. As you will learn, this will make your engineers available to focus on what matters the most, the key features of your project.

<include src="TweetQuote" quoteText="Relying on battle-tested solutions allows your engineers to focus on what matters most to your company — the unique features of your SaaS products."/>

## Introduction

Before going into the details, I need to give you a short background of Document360, which will help you to understand the context of the article better.
 
[Document360 is a self-service knowledge base product](https://document360.io/) that helps you to create public or private product documentation. Take as an example [Auth0's own documentation](https://auth0.com/docs). Using Document360, you can easily build such product documentation.

![Document360 logo](https://images.ctfassets.net/23aumh6u8s0i/1EvAgNetdKQ85x3DI6FOtz/7c207131cb5d55a5cc6ad5b05cd9450d/document360_logo)
 
When the idea for Document360 was conceived at the end of 2017, one of the key decisions we have made was to build a solution to scale to unlimited users without any architectural changes. This means that the product has to serve 500 customers today and it shouldn't suffer big architectural changes to serve 500,000 customers in a few years down the line.
 
Architecturally, this requires a different level of thinking and infrastructure requirements when you are designing a system that's capable of 500 customers and 500k customers. You need to be careful you are not over-engineering the solution, which will end up being difficult to manage and very expensive.
 
For example, let's say you have the requirement to pick a video file from a storage location to do some processing (like creating a transcript) and to store the result in a third-party storage location. When you are looking at processing 5 video messages per day, the solution is pretty simple, but imagine if you are YouTube or Wistia and need to process 100,000+ videos per day. Then, this single piece of functionality will require significant architecture and infrastructure investment.
 
If you do not plan correctly and decide to build scalable components yourself, your valuable software engineering time will be spent on creating basic versions of those functionalities. The cloud Platform as a Service (PaaS) market has evolved significantly in the past 5-8 years and, today, there is a specialized offering for each piece of the puzzle. It might be a smart move to pick the required Lego blocks and assemble it together rather than building everything yourself.

## Core Services for Cloud Scaling

For Document360, there are five core pieces of the product that required cloud-scale thinking:

1. the Identity Management (user authentication) system;
2. an user-facing web application;
3. technical-writers-facing web application;
4. a search engine;
5. and data storage.

Before going into identity management, which is the core of this article, let's quickly take a brief look at the background about other scalable parts of the architecture.

### User-Facing and Technical-Writer-Facing Web Apps
 
These web applications are straightforward requirements. Both applications should be scalable, reliable, and fast to provide a great experience to both end customers and technical writers. We decided to use [Microsoft Azure Web Apps](https://azure.microsoft.com/en-gb/services/app-service/web/) as the core front-end facing technology with [Azure Traffic Manager](https://azure.microsoft.com/en-gb/services/traffic-manager/) to route the traffic to the closest location.

### Search Engine
 
For any self-service knowledge base product, a good search engine is the key. These days, people do not navigate through your structure, they will just go and hit that big search box to look out for answers. We need to make sure the search feature is robust and, again, scalable when 1000's of customers arrive. There is no point in building this in-house. As such, we decided to go with [Algolia as our search provider](https://www.algolia.com/).

### Data Storage
 
A document management product like Document360 is full of text documents, so we need a reliable storage (database) with fast read and write capabilities and that can also scale as we grow. For this feature, we decided to go with [MongoDB cloud as our data storage provider](https://www.mongodb.com/cloud).

## Identity and Access Management with Auth0

Now, let's get a bit deeper into the main part of this article: ["Identity Management as Service"](https://auth0.com/learn/cloud-identity-access-management/). Document360 got various types of users logging into the system. When you are building a public facing self-service knowledge base, your draft writers and editors need to safely login to the system to produce relevant content. In some scenarios, where the customer decided to keep their self-service knowledge base private to the organization, then the whole organizations need to securely login in.

![Managing Identity with Auth0](https://images.ctfassets.net/23aumh6u8s0i/56TDJXutAc7DPAGwcknHY9/0ce17a9352d60d4a5382acf67f55c2e4/p-dashboard-6fc11ba51b)

Out of the five core areas of Document360, getting the initial authentication part in a secure, reliable, and scalable part is the most important aspect. For this, we decided to go with [Auth0 to provide the initial login and user authentication for our product](https://auth0.com/).

There are few reasons why we decided to use Auth0 instead of custom building our own identity providers:

- **Enterprise-Ready**: Even though capturing credentials (username/password), validating them against your database, and issuing a validation token might look like a simple task, soon, everything get complicated when you look at the scale factor. It would have taken months for our developers to build [an identity solution with the B2C features that Auth0 provides](https://auth0.com/b2c-customer-identity-management). More than that, it would take years to reach the level of quality and security of what Auth0 can provide.
- **Hack-Proof**: These days, when you are building a SaaS product like Document360, you need to worry about the DDOS attack and identity hacking. Every now and then, there is something on the news saying that one of the top websites was hacked. As such, it's not worthing the risk for us to do it ourselves. A product like Auth0 deals with billions of identity validation every day will be [better equipped and more secure than any in-house solution that we come up with](https://auth0.com/security). Enabling functionalities like [breached password detection](https://auth0.com/breached-passwords) enables that our users data is secure..
- **Trivial to add more providers**: Initially, we are starting with a standard username/password for identity verification. However, our plan in later stages is to support more identity and [single sign on (SSO)](https://auth0.com/single-sign-on) capabilities. By using Auth0, we can rest assured that, when the time comes, we will be able to [easily support other identity providers like Azure Active Directory, LDAP, and social identities (like Facebook, Google, LinkedIn etc)](https://auth0.com/docs/identityproviders). With Auth0, this is more of a trivial configuration change rather than spending weeks building support for new identity providers.
- **Low cost**: If we put together the total investment required to build and manage an identity solution, we would be amazed. The effort and the investment will all add up pretty quickly because you will need specialized engineering resources blocked just for this feature and for the infrastructure requirement. By using Auth0, we save money by simply [paying based on our usage](https://auth0.com/pricing). That is, we pay more when we make more money.
- **Rules trigger on identity**: This is one of the cool features we take advantage of at Auth0. We have requirements like, whenever a new user signup, we need to notify the sales team. With Auth0, we achieved this by plugging in [the Zapier integration after a successful authentication](https://auth0.com/rules/zapier-new-user). This was trivial.
- **Single Sign On**: In the Document360 case, we have two different web portals. One for where the Technical writers produce knowledge base content and another one for user/customer facing website (public or private). When the customer decides to go private, then [a seamless Single Sign On experience](https://auth0.com/docs/sso/current) is required between both the portals. This is achieved seamlessly using Auth0.

<include src="TweetQuote" quoteText="By using Auth0, we save money by simply paying based on our usage. That is, we pay more when we make more money."/>

## Summary

If you are building a SaaS product today, you really shouldn't think about building things yourself. The modern way of building stuff is all about assembling the best solutions in the industry together and constructing a solid application. That's exactly what we have done in our case. The core parts of the business are running with the help of great products in the market and we act more or less like an orchestrator to assemble and create a beautiful music out of all these talents.

<include src="asides/AboutAuth0" />

## About the Author

Saravana Kumar is the Founder of [Document360](https://document360.io/), a  product that helps your team create, collaborate, and publish a self-service knowledge base for your software with ease.  Saravana is passionate about technology and he holds the famous Microsoft Most Valuable Professional title for 12 years in a row. He founded and scaled three other successful enterprise products ([BizTalk360](https://www.biztalk360.com/), [Serverless360](https://www.serverless360.com/) and [Atomic Scope](https://www.atomicscope.com/)) in the last 7 years.


Cloud-Scale Thinking from Day One for Your SaaS Products

joan-pepin

As CSO, Joan is responsible for the holistic security and compliance of Auth0's platform, products, and corporate environment. She brings 20 years of experience to the role, with a career that has spanned a wide variety of industries, including healthcare, manufacturing, defense, ISPs, and MSSPs. <br /><br />Previously, Joan served as Business Information Security Officer (BISO) at Nike, Inc, CISO, and VP of Security at Sumo Logic, and held different positions at Guardent/Verisign/Secureworks organization. Joan holds a patent for developing the methodology to assess whether a communication contains an attack. <br /><br />She is also is a well-recognized thought leader and has spoken at major events, such as RSA, WhiteHat Security Summit, and Forrester Security Summit, and is frequently called upon for her expertise and commentary in Cloud Security and Compliance in large-scale and DevOps/CI environments.

Chief Security Officer (CSO)

Joan Pepin

A security researcher claimed that an attacker could perpetrate a phishing scam that could target a company using the Auth0 platform based on domain. Learn about this attack, the prevalence of phishing in the industry, and how to mitigate these scams.



A security researcher working for another company recently published a blog post stating that they could potentially perpetrate a phishing attack targeting users of a website that uses Auth0 authentication. Note that phishing is not the same as hacking a code vulnerability, and therefore, no software patches can be applied because no flaw exists in Auth0's system. Let’s explore the mechanism behind this theoretical phishing attack, the prevalence of social engineering scams in today’s tech industry, and what companies and their users can do to better protect themselves.

## What is Phishing?

[Phishing](https://www.csoonline.com/article/2117843/phishing/what-is-phishing-how-this-cyber-attack-works-and-how-to-prevent-it.html) is a type of social engineering cyber attack that has been around since the 1990s and is still extremely prevalent today. Phishing typically begins with email. Emails are sent to target individuals, and these emails contain links or attachments that have malicious intent: either to install malware on the user’s device, or get them to enter sensitive data into a website that masquerades as legitimate.

Phishing attacks are [growing increasingly sophisticated](https://www.menlosecurity.com/blog/from-your-account-is-deactivated-to-oauth-the-evolution-of-phishing) in the modern landscape of the internet, and the intent is to deceive people into providing protected information, often credentials. Regardless of sophistication, however, the premise of phishing is still very straightforward.

Consider this sequence of events, for example:

1. A user of Service A (`service-a.com`) is sent an email that appears to be from Service A. The email tells the user they need to log in using a link in the email.
2. The user clicks on the link, which takes them to a login page at `malicious-service-a.com` (_not_ the real website at `service-a.com`).
3. The page has been styled to look like a legitimate page from Service A, so the user enters their credentials into the login form.
4. The credentials have then been given to the attacker, who can now access the real Service A with the victim’s stolen login information. In addition, due to the common practice of [password reuse](https://www.troyhunt.com/password-reuse-credential-stuffing-and-another-1-billion-records-in-have-i-been-pwned/), the attacker may even have access to other accounts that the victim holds on other sites.

This is just one possible example of a phishing scam flow. The attacker could just as easily ask for other kinds of personal information, or request that the user download a malicious email attachment.

## Phishing with Auth0 Subdomains

The specific idea behind the security researcher’s phishing scam was a way to target a website that uses Auth0 authentication. Auth0 supports regional subdomains: `auth0.com`, `eu.auth0.com`, and `au.auth0.com`. A bad actor could potentially attempt to scam users of a website or application that uses one of the subdomains by registering any of the other regional subdomains while using the same name. The attacker could then set up a custom page on their subdomain and, _assuming that they had access to the email addresses of users_, send them a link and attempt to solicit secure information from them. Similar scams could be attempted using _any_ domain that users could mistake for a legitimate one.

<a href="https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)">Cross-Site Scripting, or XSS</a>, was not used in the exploration of a phishing attack that could use Auth0 regional subdomains to trick users. [XSS describes the injection of malicious scripts into a vulnerable web application](https://www.incapsula.com/web-application-security/cross-site-scripting-xss-attacks.html). This exploration relied on using a custom Auth0 page in a subdomain in another region, but [no malicious cross-site code could be injected](https://auth0.com/docs/hosted-pages#why-use-hosted-pages). The ability to include JavaScript in custom pages is a feature available to Auth0 customers to enable necessary flexibility. However, _cross-site code_ cannot be executed from these pages.

## This Attack is Not New and Not Unique

As stated previously, phishing attacks have been around for decades: almost thirty years, in fact. They have become more sophisticated and insidious in their execution, but they rely on tricking people into divulging confidential information: these kinds of attacks are referred to as <a href="https://en.wikipedia.org/wiki/Social_engineering_(security)">social engineering</a>. In these scams, it is common for malicious actors to use domains that look very similar to the target domain to make their phishing attempt more convincing. This is still true now, as well as historically.

> "It's unclear why the researcher used Auth0 as a common example of phishing targeting Auth0. There are no vulnerabilities here and their research doesn't show anything new. It is simply another example of possible phishing. The same could be done with the `anycompany.com` website by using a look alike domain and then setting up a login page same as this one `https://www.anycompamy.com/Login`."
>
> –Cesar Cerrudo, globally recognized security expert and CTO at [IOActive Labs](https://ioactive.com/)

**No company that has users with email addresses is impervious to phishing scams.** There are thousands of ways to perpetrate the [same kind of phishing attempt](https://auth0.com/blog/all-you-need-to-know-about-the-google-docs-phishing-attack/) [on any company](https://www.justice.gov/usao-sdny/pr/lithuanian-man-arrested-theft-over-100-million-fraudulent-email-compromise-scheme), aside from Auth0, [making the attacks quite prevalent](https://www.tripwire.com/state-of-security/security-data-protection/three-quarters-organizations-experienced-phishing-attacks-2017-report-uncovers/) in the tech industry.

## Phishing Relies on Tricking Users

[Phishing is not the same as hacking a code vulnerability](https://blog.varonis.com/whats-difference-hacking-phishing/), and therefore, no software patches can be applied because no flaw exists in Auth0’s system. The particular phishing attack described by the security researcher is not being actively used. Auth0 provides security measures to help prevent credential harvesting via phishing, such as [Single Sign-On](https://auth0.com/docs/sso/current), [Multifactor Authentication](https://auth0.com/learn/get-started-with-mfa/), and [Passwordless](https://auth0.com/passwordless). In addition, [Breached Password Protection](https://auth0.com/breached-passwords), [Brute Force Protection](https://auth0.com/docs/anomaly-detection#brute-force-protection), and [Anomaly Detection](https://auth0.com/docs/anomaly-detection) can help mitigate the potential outcomes of phishing attacks. Auth0 also supports the use of [Custom Domains](https://auth0.com/docs/custom-domains), which removes `auth0.com` (or regional `auth0.com` subdomains) from your application and replaces with a domain of your choosing, which completely eliminates the ability of an attacker to perform this scam using Auth0 subdomains.

However, it is important to remember that **phishing scams are quite common and easy to execute if an attacker already has your users’ email addresses**. Although using an Auth0 Custom Domain or registering all regional Auth0 subdomains eliminates the attack avenue described in this specific case, an attacker could still register any other Top Level Domain name that is similar to yours and attempt to deceive your users. For example, if your company’s login domain is `login.real-company.com`, a phishing attack could be perpetrated from a similar domain, such as `login.rea1-company.com`. In addition, a bad actor could just as easily send a malicious email attachment to your users instead.

## Protecting Your Company and Users

The safety of companies and their users should be the paramount concern when discovering and sharing information regarding security. Not committing to thorough research can negatively impact customers, users, and the general technology community.

Any company implementing authentication of any kind — proprietary or using an Identity and Access Management platform such as Auth0 — should have security practices in place to mitigate phishing attacks. These practices should include regular internal anti-phishing campaigns and training, as well as Multifactor Authentication or Passwordless. Monitoring for lookalike domain names is also recommended. With the proliferation and increasing cleverness of phishing scams, the importance of awareness and training cannot be understated.

Phishing Attacks with Auth0? Facts First

Industry thought leader joins company to fuel continued growth



  **BELLEVUE, Wash. -- May 5, 2018** -- [Auth0](https://auth0.com/), a global leader in Identity-as-a-Service (IDaaS), announced that renowned identity expert [Vittorio Bertocci](https://www.linkedin.com/in/vittoriobertocci/) will be joining the company as Principal Architect. Bertocci will apply his vast knowledge of the identity industry to Auth0 in all aspects of the company, including internal and external education, product innovation, and customer integration.

Bertocci has spent most of his 20-year career at Microsoft, where he worked on the Azure Active Directory team and focused largely on improving the developer experience. As a published author of four identity books and a highly-trafficked blog: [cloudidentity.com](http://www.cloudidentity.com/blog/), his forward-thinking commentary has enabled him to speak at conferences, such as BUILD, PDC, TechEd, Cloud Identity Summit, and many other industry events around the world.

“I have followed the success of Auth0 since its inception and am very impressed with where it has been and where it is going,” said Bertocci. “I am thrilled to be joining the company and look forward to collaborating with the team to help continue its massive growth.”

Bertocci holds a masters degree in Computer Science from Università degli Studi di Genova and began his career doing research on computational geometry and scientific visualization. Over the years, he has worked with Fortune 100 and Global 100 companies and has been a sought-after evangelist for claims-based identity in mainstream use.

“My co-founder Matias Woloski and I knew Vittorio before we even started Auth0, and credit him with introducing us to many innovative identity concepts,” said Eugenio Pace, CEO and Co-founder of Auth0. “His highly technical expertise and deep knowledge of the industry as a whole will be an incredible resource for Auth0.”


<include src="asides/AboutAuth0" />

### Media Contact

Jeana Tahnk<br>
Corporate Communications<br>
Auth0<br>
[jeana.tahnk@auth0.com](mailto:jeana.tahnk@auth0.com)

Kasia Hall<br>
Matter for Auth0<br>
[khall@matternow.com](mailto:khall@matternow.com)<br>
971-246-7898


Identity Expert Vittorio Bertocci Joins Auth0

bruno-krebs

I am passionate about developing highly scalable, resilient applications. I love everything from the database, to microservices (Kubernetes, Docker, etc), to the frontend. I find amazing to think about how all pieces work together to provide a fast and pleasurable experience to end users, mainly because they have no clue how complex that "simple" app is.

R&D Content Architect

Bruno Krebs

Learn how a B2C Company implemented Single Sign-On to provide seamless integration between different e-commerce portals.

Implementing Single Sign-On in B2C Applications

Add Extra security to your company's Data without giving up the mobility your employees expect.



When is the last time you saw a jewelry shop protect their diamonds with a simple lock and key? Even before extra layers of security like alarms, motion detectors, and [biometrics](https://en.wikipedia.org/wiki/Biometrics) were invented, jewelers hid their diamonds and even put out fakes to deter criminals.   

In your company, data is as valuable as those diamonds — so why are you protecting it with a [simple username and password?](https://auth0.com/blog/modern-authentication-for-your-clients-made-easy/;)

Passwords are the keys that access your company's data, but like the traditional lock and key, any mediocre cybercriminal can easily decipher your password. In fact, it's now possible for your mother to easily hack your Facebook account.

![Your mom can hack your Facebook account.](https://images.ctfassets.net/23aumh6u8s0i/5Jkvtw1v3sCHI5g73P2Jrb/856a27a1a2c9ed202895e1b24e098a19/facebook-account-Password-Hacker)

Technology enables hackers to test billions of password combinations per second, exposing  [_90% of all passwords_](http://www.telegraph.co.uk/technology/news/9802062/90-of-passwords-vulnerable-to-hacking.html). Facebook realized this when they [discovered](http://www.businessinsider.fr/us/90-percent-of-passwords-vulnerable-to-hacking-2013-1/) 600,000 imposters were attempting to access users' personal information every day using stolen passwords.

Companies like LinkedIn, Google and Twitter decided that they needed extra layers of security to strengthen passwords and protect their users' data. The solution: two-factor authentication (2FA).

<include src="TweetQuote" quoteText="Even your mom can try hacking your Facebook account."/>

## Two-Factor Authentication Adds the Extra Security You Need

If you have logged into Facebook, Twitter, or Google within the past few years, you have come across two-factor authentication.

Two-factor authentication (2FA), sometimes referred to as [multifactor authentication](https://auth0.com/learn/multifactor-authentication/), is a method used to verify a user's identity when they are trying to access an application. In addition to a password, 2FA requires you to provide a second piece of information to confirm your identity.

The first step is to sign into your account with a username and a password. This is the first factor of the two-step process.

![First factor of two-factor authentication: username and password.](https://images.ctfassets.net/23aumh6u8s0i/8KlwIklqafMi98LgppRJQ/8cf66446ba2f526fae327d3587875073/Gmail-login-procedure-email-and-password)

Unlike the ineffective security questions such as your mom's maiden name or your school's mascot, the second piece of information used in 2FA is extremely hard for cybercriminals to acquire. The idea is to create a second factor that is unique to the user, which is often something they possess, like a smartphone, or even something biological, like a fingerprint.

After you enter your credentials in step one, you will be prompted to add the second factor. There are several pieces of information that can be used, which we'll share below. In this case, the user chooses an SMS verification.

![Google asking SMS verification on two-factor authentication](https://images.ctfassets.net/23aumh6u8s0i/6cmLDT4KHVDbAOg1HT5kQb/3e4d0169d8f56f1282a188dfdccdec6f/2-step-verification-google)

Hacking a password is extremely easy, but obtaining a physical device that generates the second code or stealing biological features is not as easy, which is why 2FA is one of the most effective security approaches available.

### 2FA Approaches to Give Your Employees Convenient Options

If you are considering 2FA for your business, there are several approaches for the second factor known as one-time passwords (OTP) that don't require the technical sophistication of biometrics (fingerprints, retina scans).

Your OTP options include:

* **SMS (Text Messages):** SMS is the most popular method of 2FA. After a successful login, the user receives a 5-10 digit code via SMS on their phone, which they then enter into the application for access.
  - **_Pros:_** Employees are comfortable receiving text messages and it is cost-effective to implement.
  - **_Cons:_** Relies on cell reception and a physical phone. If stolen, you can't authenticate.
* **Email:** An OTP can be sent to a secondary email account for verification. This technique works in the same way as SMS, where a 5-10 digit code is sent to the email address.
  - **_Pros:_** Employees can get emails on multiple devices, it’s cost-effective and everyone uses email.
  - **_Cons:_** Emails sometimes fail to deliver, and hackers can gain access to your email and get the code.
* **Voice Call:** Although not a common practice, users can choose to receive a call to a designated phone number with the OTP delivered using a text-to-speech service.
  * **_Pros:_** All employees are comfortable with phone calls and voice doesn't require a data connection.
  * **_Cons:_** Calls can be intercepted, forwarded or voicemails hacked. If stolen, you can't authenticate.

![Multiple two-factor authentication screens](https://images.ctfassets.net/23aumh6u8s0i/wLMMuoTSqpF5OdmetC1mt/f733ee40015326c4f390aebdc7f2b359/Twitter-Card-Multifactor)

* **Hardware Tokens:** This is a common enterprise practice, where employees are given a physical device such a [*key fob*](https://en.wikipedia.org/wiki/RSA_SecurID), or other devices that dynamically generates a code for the user.
    * **_Pros:_** It is a standalone solution that doesn’t require reception or WiFi connection.
    * **_Cons:_** The pieces are expensive, hard to manage and devices are easily misplaced or lost.
* **Software Tokens:** Instead of carrying around a device, software tokens require employees to install an application that runs on their computer or mobile device.
    * **_Pros:_** Apps are easy to use, easy to update and easy to apply patches when needed.* *
    * **_Cons:_** Employees must download to their personal device. Apps can be compromised without user knowledge.
* **Push Notification:** Apps like Auth0 [Guardian](https://auth0.com/docs/multifactor-authentication/guardian) enable you to receive a push notification in the same way you get alerts from your calendar app or news activity. The notifications request a response of either a “Yes” or a “No.”
    * **_Pros:_** There's a direct and secure communication between authentication and the smartphone application.* *
    * **_Cons:_** If a device is stolen, users must go online to cancel the device before it is compromised.

Although there are pros and cons to every 2FA option, keep in mind that it is impossible to get your enterprise authentication 100% secure. Implementing 2FA increases your security no matter what, so select a second factor that works best for your employees.

## 2FA Goes Beyond Security to Improve Output

While the primary reason businesses implement 2FA is for the extra layers of security, the methodology of 2FA also enhances employee productivity and operational efficiencies.

Simply by requiring a second form of identification, there is a low probability that a hacker can successfully impersonate an employee and gain access to your systems. If an employee loses a mobile device or a password is stolen, 2FA provides enough time for your company to remedy the issue before too much damage is done.

Beyond these obvious mobile security benefits, 2FA also provides the enterprise with a few other advantages that affect your bottom line.

### Increased Productivity

Employees are now mobile, working on their personal devices outside the office. As a result, they are more productive and businesses are reaping the rewards of this newfound flexibility.

2FA is an [effective method](https://auth0.com/blog/enhancing-productivity-with-identity-and-access-management/) to secure mobile devices where employees can safely access company-owned applications, data, shared documents, and other systems from virtually any device without putting the company at risk. Corporate IT can rest assured that if a device is compromised, 2FA will make it really hard for anyone to gain illegal access.

![Nowadays, multiple devices are used by employees.](https://images.ctfassets.net/23aumh6u8s0i/1cewJALdmtvtG73hmdAidf/48f0e65905372c10848fd8fa38e27b73/DifferentDevices2)

Employee mobility has created a happier and [more productive](https://www.forbes.com/sites/danielnewman/2016/03/29/is-mobility-the-answer-to-better-employee-productivity/#6c493277131c) workforce, and 2FA is the best method to provide the security measure that reaches outside the firewall to make it all possible.

<include src="TweetQuote" quoteText="Two-factor authentication also means increased productivity."/>

### Increased Awareness

Stolen credentials are the biggest security risk for every business, but most companies don't even know when an employee's credentials have been compromised until it is too late.

In the devastating 2014 [eBay data breach](https://www.alertlogic.com/blog/the-ebay-breach-in-review/), the attackers spent over 229 days within eBay's systems because the stolen passwords were logged as appropriate access. 2FA notifies the account owner immediately that their credentials are being used by someone other than them.

![Google showing an alert that a non-regular sign in was blocked.](https://images.ctfassets.net/23aumh6u8s0i/2RIA9ufpiptT3aL9kDTqyD/827a3f112766779f58916b5706bb25c4/Google-block-sign-in-attempt-prevented-email)

If the hacker has both security factors, there is a good chance that the account owner has already reported a security concern because it means they are missing a device or received an alert that is inconsistent with their activities. 2FA gives the business a new level of awareness level to stop crimes before they start.

### Cost Savings

There are several ways 2FA can help your company save money. The biggest is in preventing a data breach, which can cost a company up [to $3 million](https://www-03.ibm.com/security/uk-en/data-breach/). Beyond mitigating theft, there are two other ways 2FA can help you save money:

1. **Reduced Help Desk Inquiries:** Time is money and reducing the amount of time your IT expert is spending resetting passwords can save the company a lot of money. According to HDI, at least 35-40% of help desk calls are related to password resets, which require an average of 20 minutes of the help desk technician’s time to complete. 2FA gives employees a secure way to reset their own passwords, resulting in fewer calls and more productive employees.

2. **Cloud-based 2FA:** Some larger companies have implemented 2FA using hardware tokens (or "fobs") that employees carry around like a thumb drive. These tokens generate one-time passwords, but they are expensive and hard to manage as employees often lose them or keep them after they leave the company. [Cloud-based tools](https://auth0.com/learn/cloud-identity-access-management/) like Auth0 provide soft tokens like SMS and Push Notifications, giving companies a new, cost-effective way to utilize 2FA.

![Crypto card two factor authentication](https://images.ctfassets.net/23aumh6u8s0i/8TP8HQgFeZNfz4WQBqVGK/c441ae38290e1654de781afd2ca2ce6f/CryptoCard_two_factor-1024x690)

Identity access management [tools](https://auth0.com/learn/cloud-identity-access-management/) allow businesses to [implement 2FA ](https://auth0.com/learn/two-factor-authentication/)for their internal systems in the same way Google, Twitter and Facebook use it to address consumer concerns. Not only will you gain that added layer of security, but the enhanced productivity, awareness and cost savings make 2FA a viable tool for your bottom line.

## Empower Your Passwords, Improve Your Business

In the same way we still use keys to unlock our doors, passwords are our preferred method of accessing our digital worlds. Passwords have been part of humanity for ages and are not going anywhere, but that doesn't mean we need to rely on them solely to protect our company's valuable assets.

2FA augments passwords in a unique way that not only adds an important layer of extra security but also enhances employee productivity helping your bottom line.


Why Every Business Needs Two-Factor Authentication Security

Pace to continue momentum of company's exponential growth



**BELLEVUE, WA -- Dec. 12, 2017** – Auth0, a global leader in Identity-as-a-Service (IDaaS), today announced that company co-founder Eugenio Pace will serve as its new chief executive officer, effective immediately. The company is grateful to Jon Gelsey, Auth0’s former CEO, for four years of outstanding service.

Pace has been integral to Auth0’s exponential growth since co-founding the company with Matias Woloski, CTO, in 2013. Most recently as chief customer officer, Pace has been part of the leadership team that has led to Auth0’s significant milestones, such as raising nearly $55M in total funding-to-date, and in 2017 alone:

* Doubling its customer base with 1,500 new companies;
* Increasing revenues by more than 100 percent; 
* Hiring more than 120 new people; and
* Opening offices in London, Tokyo, and Sydney.

With an extensive technical background and previous senior management positions at Microsoft, Pace will focus his efforts on continued product innovation, customer success, and global expansion. 


“I’m honored to be at the helm of Auth0 at such an exciting stage in the company’s evolution. The past few years of exceptional growth are a strong indicator of where we are heading, and I am very appreciative of Jon’s dedication to getting us to this stage,” said Pace. “We hold steadfast to our mission of providing the easiest-to-use IDaaS platform to solve the most complex and large-scale identity and access management challenges. Our amazing team has enabled us to stake our leadership claim in this market, and I’m thrilled to continue our mission as leader of this organization.”
 
<include src="asides/AboutAuth0" />


Auth0 Names Eugenio Pace as New CEO

What you need to do to make sure that your company is secure.




Compared to how much we think about the problem of *personal* identity theft, business identity theft can seem almost like an afterthought—but it shouldn't be.

Business identity theft has been going on for decades, but as time goes by and technology improves, the thieves get more advanced and the losses get worse. This is a threat that is ramping up.

In July 2017, the IRS reported that they'd seen a **250% jump** in the number of business identity theft cases when compared to the year before and about $137 million total in [damages](https://www.bizjournals.com/kansascity/news/2017/07/31/irs-business-identity-theft-cases-jump-250-so-far.html) *so far*.

If you run a business or are responsible for its finances, security or human resources in 2017, then you need to be aware of the dangers of business identity theft.

## Business Identity Theft: What is It?

Just like personal identity theft, business identity theft involves a variety of attack vectors and forms. Generally, however, thieves will either steal or spoof the identity of a corporation in order to get either undeserved tax benefits (through filing a fraudulent return, for instance), or so they can open up false lines of credit (and make exorbitant, discreet purchases).

Thieves prey on businesses because the sums involved in the theft are much greater, while simultaneously attracting less attention:

* Steal a credit card and immediately try to buy $10,000 worth of something resellable—the odds of getting caught are high.
* Steal an open line of credit in a corporation's name and immediately try to buy $10,000 worth of something resellable—the transaction might not even attract scrutiny.

Years ago, masquerading as a business could be as easy as going to a local Secretary of State's online portal and simply “requesting changes” on nearly any given company's official records—they could add content, delete content, or more importantly, edit their name into the incorporation documents. Once your name is in the “official” record for that business, you can try to apply for lines of credit in its name or even try to file a fraudulent tax return.

## Business Identity Theft Today

Today, business identity theft takes many forms. While simple methods like emulating a company's letterhead and sending faked correspondence are still plausible, many thieves have developed more sophisticated techniques.

* They can use virtual front-offices to convince your staff that they're legitimate and trick them into clicking on phishing links.
* They can break into an executive's email and then send fake emails to the finance team asking for a last-minute wire to a foreign bank account.
*  They can even plant an unsecured WiFi hotspot in or around your office, hoping an employee will connect to it by mistake and leave their system open for hacking.

Business identity theft can be something as simple as a thief looking up your Employer Identification Number (EIN) and using it to file a fake tax return. It can be something as complex as gaining access to your internal email server and using it to send fraudulent wire requests to employees in control of your company's finances.

The truth is that businesses, by virtue of communicating with the outside world and processing transactions and needing information to flow freely *inside*, have a lot of exposure to threats and vulnerabilities from the *outside.* This makes businesses a natural target for thieves—especially today, when there are so many touchpoints available for thieves to capitalize on.

## Business Identity Theft Statistics

The number of business identity theft cases every year is not as high as the number of personal identity theft cases—but the outcomes are much more dire and can often result in businesses shutting down. Plus, according to the data we looked at from Kaspersky Lab, Phishlabs and the Treasury, this is a growing threat. Here is business identity theft “by the numbers”:

* **350—**The number of corporate tax returns the IRS flagged for potential business identity theft** **in 2015.
* **4,000—**The number of corporate tax returns the IRS flagged for potential business identity theft in 2016.** **
* **10,000—**The number of corporate tax returns the IRS flagged for potential business identity theft during the first six months of 2017.
* **6,176—**The number of EINs the Treasury had reported as “associated with fictitious businesses” as of 2015.
* **1.1 million—**The number of taxpayers not informed of employment-related identity theft committed in their names between 2011 to 2015.
* **300%—**The percentage increase in ransomware attacks targeting businesses from 2015 to 2016.
* **$325 million—**The amount paid to hackers over the CryptoWall 3 ransomware in 2015.
* **230 million—**The number of computers compromised by the WannaCry ransomware within one day.
* **20%—**The number of business identity theft incidents that were caused by employees and could have been prevented with better security awareness in 2016.
* **$500,000—**How much Village View Escrow lost in two days after an attacker was able to process 26 international money transfers in their name.
* **60%—**The percentage of small businesses that go out of business within one year after being affected by business identity theft.

Business identity theft is a serious problem. It has imperiled businesses across the country and led to losses of millions of dollars. There are steps, however, that you and your business can take to lower the risk of business identity theft.

## Preventing Business Identity Theft

In an effort to fight the fraudulent tax return aspect of business identity theft, the IRS is planning to ask tax professionals for more context on the corporations they're filing taxes for in 2018, such as:

1. **Name and SSN of the person signing the return:**to ensure that the person signing the corporation's return is a legitimate employee or trustee of the corporation
2. **Previous payment history:**to ensure that this request lines up consistently with previous tax returns, and wasn't pulled out of thin air by a fraudulent requester
3. **Filing history:**to ensure that a corporation has filed all relevant tax forms and not solely the return—a good sign that the person signing the return is an actual corporation rather than a single person

There are a few important steps you should take as a business to be proactive and lower your chances of being affected by business identity theft:

1. **Sign up for alerts from your financial institutions:**Your corporate credit cards should be set to automatically freeze or notify you if a transaction above a certain amount is processed.
2. **Educate your employees about phishing:**Sophisticated email attacks can be almost indistinguishable from real emails, and can result in huge breaches. Ensure that each member of your team understands this (https://auth0.com/blog/the-new-trend-of-artisanal-spam/).
3. **Limit disclosure of sensitive information:**The more you distribute your company's EIN, the more surface area you're creating for possible attacks. Limit disclosure to when it's absolutely necessary, and try to communicate it over the phone or in-person rather than over a stored medium.
4. **Sign up for alerts with your local Secretary of State:**If anyone tries to change your business's registration information, you can receive an email from your local Secretary of State notifying you of the change. If it's not something you authorized, you can have the fraud immediately rolled back.
5. **Check your credit reports regularly:**Whether through Dun & Bradstreet or one of the big three credit bureaus, you should be checking on your credit report to make sure that there's nothing suspicious going on.

Do each of these 5 things, and you'll have a strong set of practices that will help make sure that if you are the victim of business identity theft, you know about it soon enough that you can prevent any real damage from taking place.

If you want to truly prevent the possibility of anyone compromising your company's security, of course, then you need protection at the system-level.

## Do Something About Business Identity Theft with Auth0

Keeping your business truly safe from business identity theft starts with controlling who has access to your systems.

Proactive measures are great, but you need to keep people from being able to access your sensitive information in the first place if you truly want to prevent business identity theft.

### Enable Breached Password Detection

With Auth0's [breached password detection](https://auth0.com/blog/breached-password-detection-anniversary/), you can ensure that your employees and customers aren't logging in with credentials that have been compromised elsewhere on the web. If someone tries to log in and our breached password detection finds their username and password somewhere on the web, they will be automatically notified of this and forced to change their password.

Without breached password detection, hackers with access to lists of breached credentials can sign into corporate intranets and wreak havoc. We've identified more than 3.5 million instances of Auth0 users trying to log in with breached credentials!

### Enable Multifactor Authentication

[Multifactor](https://auth0.com/multifactor-authentication) authentication is another important line of defense against the danger of customers and employees logging in with compromised accounts, but it's also an important security step to take in general.

With multifactor authentication, a user's identity is double-checked when they undertake sensitive operations like logging in from a new location or accessing company information.

Enabling multifactor authentication ensures that thieves can't simply steal a username and password, log into an executive's email account, and start withdrawing funds or wiring them to themselves. Instead, they'll be prompted to enter a code into their smartphone or place their finger on a biometric scanner—which they won't be able to do.

## Keep Your Corporate Identity Safe

Thieves hijack the identities of businesses because they're both bigger and more vulnerable targets than individual consumers.

They especially like to target small and medium-sized businesses that don't necessarily have the capital to invest upfront in building out their security.

But it is possible to prevent business identity theft. By being proactive and signing up for alerts, and by securing your internal systems with breached password detection and multifactor authentication, you can increase the difficulty of stealing your business's identity dramatically.


Business Identity Theft Is On The Rise

eHk3ciM

I am the Group Manager, Developer Content at Okta, and a Google Developer Expert in Web Technologies and Angular. I'm passionate about identity, authentication, constant learning, and developer communities. As a developer advocate, engineer, mentor, and international speaker, I love learning from and sharing with other inhabitants of the tech space.

Group Manager, Developer Content

Kim Maida

We're a distributed company with a collaborative culture and we're always striving to improve ourselves.



## Company Culture

Tech company culture is always a hot topic. There's a constant stream of blog posts and news stories about what companies are doing right, what they're doing wrong, how employees should act on benefits that can be considered "[dark perks](https://medium.com/@wwalser/unlimited-vacation-is-a-dark-perk-and-you-should-use-that-to-your-advantage-f30495f0df23)", how companies respond to violations of their cultural values, to what degree companies should hire based on whether a prospective candidate is a "good culture fit", etc.

These are important discussions, and they're always worth having. Company culture should be fluid. It should evolve as a company scales, and change and adapt if it stifles growth or cohesiveness. Culture can also erode: it's not a permanent institution that maintains itself without effort. Regular, open discussions about company values are a vital part of a successful, evolving culture.

We value transparency at Auth0, both for current _and_ prospective employees. We've shared [how we hire engineers](https://auth0.com/blog/how-we-hire-engineers/) (this general process is roughly equivalent across most departments in the company in addition to Engineering), and we'd now like to share our culture and values!

## Culture and Values at Auth0

**Culture** is the collective personality of a company. This encompasses who we are _and_ who we _aspire_ to be.

**Values** guide us in our day-to-day interactions and decision-making.

At Auth0:

* We are obsessed with delivering **customer value**
* We **trust** and **respect** each other
* We hold ourselves to **high standards**
* We win through **collaboration**
* We continuously **experiment, learn, and innovate**
* We are radically **transparent**
* We are **passionate**

You can read about [our company values in more detail here](https://auth0.com/careers/culture).

We _strongly_ value the ability to refine, add, and remove values that, as a collective body, we feel would benefit from modification. Companies aren't static, and our values shouldn't be either.

<include src="TweetQuote" quoteText="Companies aren't static, and company cultural values shouldn't be either."/>

Our values on trust and respect also include a "No BAP" policy. To put it simply, this means:

* No Bull$hit
* No A$$holes
* No internal work Politics

In an anonymous culture survey of current Auth0 employees, people overwhelmingly expressed positive feedback. They most commonly mentioned respectfulness and no BS when asked how they would describe Auth0's culture.

<include src="TweetQuote" quoteText="Auth0's mantra: No BAP = No BS, No A$holes, No internal Politics."/>

### Culture is Much More Than Perks

As stated above, our culture is the _personality_ of our company and its aspirations. When looking at company job postings, it can be easy to misinterpret culture as just a list of benefits and perks. Auth0 has many perks, including:

* Flex hours: set the hours that work best for you
* Lots of vacation time: ranging from extensive to unlimited, governed by regional laws
* Free food and snacks in the headquarters offices
* MacBook Pros
* Expensing for software, hardware, home office equipment, co-working space, and travel
* Annual all-expenses paid international company offsite and team offsites
* Etc.

However, perks are only a minor component of _culture_. A company can have perks that sound great on paper, but if the culture doesn't truly support the _use_ of those perks, they become pointless, or even damaging. For example, if employees are told they have unlimited vacation but then are shamed for taking advantage of it, this becomes a _dark perk_. If a company has an arcade machine and a sofa that gather dust because the culture discourages taking breaks, the perk backfires.

Perks are integrated into the culture at Auth0. Employees and senior leadership are tremendously hard-working, while we also understand and value the necessity of vacations, social time, and expenses that promote both a comfortable work environment (onsite or remote) and continuous learning.

![Auth0 employees together at offsite in Cancun, Mexico](https://downloads.ctfassets.net/23aumh6u8s0i/2HZQrybXGJ5W4l8dbrQouc/39183cd44a7535b7ef5031794abcbf13/logo-assemble)
_Auth0 2017 company offsite in Cancún, Mexico_

### The Culture of a Distributed Workforce

Auth0 is a distributed company. Our employees live all over the world, and the majority of us work remotely. We have headquarter offices located in Seattle, Buenos Aires, and London. Employees living near the offices can choose for themselves whether they want to work from those locations or their own homes (or a mix of both).

Remote work can be fraught with challenges, but we have the benefit of having _grown up_ as a remote workforce. We take advantage of collaborative tools like Slack, Zoom, Google Apps, and more to work together. We hack on the tools to help them do more for us (e.g., with [Slackbots powered by our Webtask platform](https://auth0.com/blog/build-a-serverless-slack-bot-with-webtask/)). Collaboration and transparency are some of our core values, and it could be easy to fall short in those areas in a distributed company. Great care and attention are paid to ensure that doesn't happen.

Our employees are very self-directed and are responsible for managing their own time. This is a requirement in a distributed company with workers spread across the globe in different timezones. This promotes a healthy work-life balance and plenty of flexibility, although it can occasionally result in people working self-imposed long hours if they have trouble "switching off" when their workday is supposed to end.

> People manage this in different ways; some set daily reminders that alert them to eat meals, go outside, stop working in the evening, etc.

Each year, Auth0 pays all expenses to bring employees to one location to meet face to face (so if thinking of applying, make sure you have a passport!). We have sessions, awards, team-building, leisure activities, and dine and socialize together as a company. This is a tremendously enjoyable and valuable time, and its importance for a distributed workforce cannot be understated.

![Auth0 2017 company offsite: company award winners with Senior Leadership Team](https://images.ctfassets.net/23aumh6u8s0i/5SZ8NxdIqoNtkgq7unZmuE/61da68d51442fae9cbc97364c3799537/authziros-2017)
_Auth0 2017 company offsite: company award winners with Senior Leadership Team_

### The Connection Between Company Culture and Diversity and Inclusion

Auth0 is expanding quickly. In this time of rapid growth, it's even more important to pay attention to our culture and evolve and scale it in order to preserve the respect, dedication, and passion that has propelled us to the place we're at now.

New initiatives are being formed. We're taking strides to diversify further. As a distributed, international company, we have awesome opportunities to attract amazing talent across global cultures. In addition, we aim to attract many talented people across genders.

There is a connection between _company culture_ and _diversity and inclusion_. This connection exists even if current levels of diversity don't yet meet aspirations! A company that places strong emphasis on respect, trust, and collaboration fosters a welcoming and inclusive environment for _every_ employee. Incoming candidates experience this first-hand during the [hiring process](https://auth0.com/blog/how-we-hire-engineers/), as we interface heavily with people throughout the interviews and exercises.

<include src="TweetQuote" quoteText="Auth0's values emphasize respect, trust, & collaboration, providing an inclusive environment for all employees."/>

A collaborative and respectful culture fosters equal treatment for everyone, regardless of age, race, gender, sexual orientation, religion, disability, seniority, or position level. We are dedicated to upholding these cultural values as we grow as a company.

## Conclusion

At Auth0, our culture is very important to us, and we're dedicated to continually improving it. We're also working hard to find more ways to reach out to a diverse range of talented individuals who would like to join us. If you have any suggestions for us, we're always looking to improve.

If you'd like to see what it's like to work with us, we encourage you to check out our [job openings](https://auth0.com/careers) and get in touch! In addition, we have community initiatives and are always looking for people who are interested in contributing via our [Guest Author](https://auth0.com/guest-authors) and [Auth0 Ambassador](https://auth0.com/ambassador-program) programs. In the spirit of transparency, we also have many open-source libraries that welcome contributors, such as [auth0.js](https://github.com/auth0/auth0.js), [Lock](https://github.com/auth0/lock), and [more in our GitHub](https://github.com/auth0). 

We'd love to work with you!

![Auth0 offsite 2017](https://images.ctfassets.net/23aumh6u8s0i/6cAp9YoIDRkNOZOCvNkccB/0d9a846c991975967e08a566a0a7a7e9/offsite)


Our Culture and Values at Auth0

Explore how staying a step ahead of your customers can revolutionize your company.



**TL;DR:**  Predictive analytics is the term used to describe using data to make highly informed guesses about future outcomes.  In this article, we will explore the technique and see the benefits.


During the 2010 FIFA World Cup, soccer fans around the world were absolutely captivated — by a German octopus. Paul, as he became known, correctly [predicted](https://en.wikipedia.org/wiki/Paul_the_Octopus) the outcomes of all the games that the German national team played in *and* correctly predicted Spain would win the entire tournament. 

He was heralded as a soothsayer, an oracle, a being somehow able to see into the future. The Spanish Prime Minister even offered him state protection! 

But Paul was just an octopus picking flags on a whim. It was just luck — nobody can predict the future, right?

![Paul the Octopus](https://images.ctfassets.net/23aumh6u8s0i/6ZtFUCadPJZI5AdPzSZNlP/4964b213b71586ed52dfa4b054484d3e/paul-the-octopus)

Well, an octopus probably can't, even if Paul gave it one heck of a run. But the odds that your business could might be higher than you think. That's in large part due to the huge amount of data that businesses are now privy to, and the tools we have available to analyze it. 

These ideas are encompassed by the term *predictive analytics*, and it's what we'll talk about today. How do they work? What types of prediction can your business expect? And how do you get the right data to make good predictions? While Paul may keep his mystical secrets, the answers to all these questions are yours for the taking.

## What is predictive analytics?

Simply put, predictive analytics is using data to make highly informed guesses about future outcomes. For businesses, the most common application of this is in [user behavior](https://amplitude.com/blog/2016/06/14/10-steps-behavioral-analytics/). By observing what past users have done, you should be able to better understand what future users will do. Businesses use this to shape users' paths to increase predictability. 

For example, Tesco, a UK grocer, [used](https://hbr.org/2011/12/know-what-your-customers-want-before-they-do) user behavior data to see what their rewards program members were buying together. They noticed that “Clubcard shoppers who buy diapers for the first time at a Tesco store are mailed coupons not only for baby wipes and toys but also for beer.” Why? “Data analysis revealed that new fathers tend to buy more beer because they are spending less time at the pub.”

This is a clean example, and to get to a place where your business can boast good predictive modeling requires a couple of things that are implicit in the mascara/eyeliner scenario:

- **Good data collection** from all parts of your business at all times.
- **Deep understanding of customer behavior** that is based in data and not gut feeling or supposition
- **Predictive analytics tools** that makes your data workable and tracks your experiments

This forms the groundwork of success with predictive analytics. There's no reason why any company can't start utilizing their data in order to make predictive analytics work for them, and most companies will have some — if not all — of these systems set up already. 

But whether you're all set up or just starting out, you probably aren't fulfilling your predictive analytic potential. For example, how are you using your identity management (IAM) to help with predictive modeling? Are you using it at all? If you really want to get serious about your predictive capability, then you can't overlook it as a powerful avenue for predictive analytics. 


## How does IAM contribute to predictive analytics?

There are a number of ways that IAM can contribute to predictive analytics, but one of the biggest and most underutilized is gathering information with your identity management system. Login can give you a window into who your users are, what they're doing, when they're doing it and how often. 

Some of the data that your IAM can collect is:

* Location
* Device type
* IP Address
* Number of logins
* Timestamp of logins

These are all important factors when figuring out user behavior, especially number of logins, behavioral data which shows how engaged a user is with you. 

But that's not all that an IAM can help you learn. Beyond the obvious, an IAM can help you gather information by:

- **Gathering social data** by requesting access to all of the preferences and information stored in a user's social platform of choice if they're using social login.
- **Customizing profiles** by automating questions to be asked at login. When done properly, [progressive profiling](https://auth0.com/blog/how-profile-enrichment-and-progressive-profiling-can-boost-your-marketing/) can give you the data *you *want about your customers without inconveniencing them or invading their privacy. 
- **Enabling demographic research** by running your users through 3rd-party data APIs to get more information about them. With Auth0, you can automate this process by integrating APIs into profile creation with [Rules](https://auth0.com/docs/rules/current), automated functions that trigger at login. If you want more data about, say, the professions, company sizes and professional roles of your users, for example, you could use Auth0 Rules to automatically run users' emails through [Clearbit](https://clearbit.com/), an API that pulls professional information. 

All of these types of data can be directly funneled into predictive models. Remember that one of the key components to creating predictive analytics for your company is *good data collection* and another is a *deep and unbiased understanding of your users*. If you aren't utilizing your IAM to help you get both of these things, you're missing a huge opportunity and setting yourself back in the process. 


## Easy ways to use predictive analytics

The potential of predictive analytics is huge, but it's a complex field that can be intimidating to unravel. Here are some of the easier ways to use predictive analytics — but keep in mind that even the simplest application will still require that rigorous back-end work to be successful. 

### Marketing

Our Tesco example was a hint at this, but one of the most predominant ways to utilize predictive analytics is marketing. This helps you tailor your marketing efforts to better sell to specific customers by looking at past data on what similar customers have bought or done. 

A great example of tailoring your marketing efforts based on data is Geckoboard's [system](https://clearbit.com/books/data-driven-sales/inbound-lead-qualification) for qualifying leads. They realized that their template for their “ideal customer” was leaving out the majority of the leads they were generating, leaving marketing with a soup of people to manually sort through. 

They decided to enrich their data to get a more complete view of their users, and use new information about the types of leads they were pulling in to autoscore leads with a more complex system:

![Point Based Lead Scoring](https://images.ctfassets.net/23aumh6u8s0i/1MF3y7XfyBsXfbyekdEdmC/8c66234ffd6d7c9cc5ae2c938393bd53/advanced-point-based-lead-scoring_1x)

This system was developed based on a combination of user behavior and good data that they automated into their system through the Clearbit API. 

These tactics are obviously not limited to discounts or leads — they could be different email copy, coupons, or ads that speak to the likely purchases, desires and vulnerabilities of a given consumer. 

### Sales revenue

Predictive analytics can lead to better sales projections because you are making a more concerted effort to collect data on customers and use it to predict outcomes. 

Take [Microsoft](https://www.microsoft.com/itshowcase/Article/Content/770/Predictive-analytics-improves-the-accuracy-of-forecasted-sales-revenue) — the company recently revealed that they've ramped up predictive analytics in their sales department in a big way. By integrating predictive analysis into their sales process, they're getting more accurate sales predictions from top down. Here's what they say about how individual reps are helped by predictive analytics: 


> “[Our most recent] model uses machine-learning algorithms and opportunity-scoring data for near real-time win/loss predictions of a sale. It helps sellers prioritize by showing whether an opportunity is hot, warm, or cold, and advises them about actions to take.”

### IAM security

<include src="TweetQuote" quoteText="When you have a good IAM in place, you can use predictive analytics to help keep you and your users more secure."/>

One of the best examples of this is anomaly detection, a security measure that flags unusual behaviors to keep users safe. For example, Auth0 offers [brute force protection](https://auth0.com/docs/anomaly-detection), which allows you to trigger security measures if someone makes too many attempts on a login. 

This type of security relies on regular user behavior — like not trying to sign in to their account 20 times in a row — and uses it to help keep users safe. You've probably been the beneficiary of protection based on your behavior without even realizing it. An email that says, “we got a login from a new computer or location — is this you?” is another type of identity protection that relies on predicting user behaviors. 

![Dropbox Signin Warning](https://images.ctfassets.net/23aumh6u8s0i/JByzpyhEpMxeLqYfUYucK/9f8ee66d608c0265c0a69d8500d8aad7/dropbox-signin-warning)

*A security email from Dropbox notes what location, time, web browser and computer are used in a login attempt that doesn't match a users' predicted (i.e. previous) behavior.*

With an IAM system like Auth0, turning on security features like brute force protection is as simple as choosing a couple of preset options, and should be a no-brainer to incorporate this type of predictive analytics technology into your business. 


## Keep looking into the crystal ball

<include src="TweetQuote" quoteText="When you start to see the power of what your data can do, you'll want to dive in with both feet."/>

Predictive analytics isn't a short-haul adventure. And when you start to see the power of what your data can do, you'll want to dive in with both feet. 

Yes, it takes time to collect good data, devise a pipeline for sorting through it, and find your correct predictive variables. That fact is probably not going to change anytime soon. You can make an easy start by getting your current software tools — like your IAM — to work for you.


Predictive Analytics: Why Is It Important?

Industry leaders join company to drive next stage of growth


**BELLEVUE, WA - OCTOBER 5, 2017** - Auth0, the global leader in Identity-as-a-Service (IDaaS), announced three additions to its executive team, further strengthening its core leadership. The recent expansion of the leadership team is in response to [Auth0’s rapidly accelerating growth in revenue, enterprise customers, and headcount.](https://auth0.com/blog/auth0-announces-record-year/)

The new executives are:

* **Joan Pepin, Chief Information Security Officer:** Joan is responsible for the holistic security and compliance of Auth0's platform, products, and corporate environment. She is a recognized thought leader in security and previously held positions as Business Information Security Officer at Nike and CISO at Sumo Logic, a leader in cloud-based log management and analytics.

* **Lewis Carpenter, Chief Marketing Officer:** Lewis oversees the company’s brand strategy and leads the team driving Auth0’s marketing efforts. He is the former CEO of Winshuttle, a leader in Application Data Management, and has helped build several market-leading technology companies.

* **Jeremy Freeland, General Counsel:** Jeremy is responsible for all legal affairs of the company. He has worked as inside and outside general counsel for several early and mid-stage information technology companies, and has significant experience with technology based transactions.

"Our tremendous success over the past year has been fueled by the amazing people who work at Auth0," said Eugenio Pace, CEO. “The addition of Joan, Lewis, and Jeremy provides us with deep expertise in each of their respective areas, and bolsters an already outstanding leadership team that will manage the next stage of growth for Auth0. We’re thrilled to have them on board for the journey.”

According to [Forrester Research](https://www.forrester.com/report/The+IAM+Market+Will+Surpass+13+Billion+By+2021/-/E-RES138932?objectid=RES138932 ), the identity and access management market is expected to surpass $13 billion by 2021. This growth is due to an ever-changing digital landscape and customer demand for secure and seamless authentication across all channels. Companies need an extensible and robust identity and access management platform more than ever and are turning to Auth0 to handle their most complex identity needs, quickly and securely.

<include src="asides/AboutAuth0" />

**Media Contact:**

Jeana Tahnk

Auth0

[jeana.tahnk@auth0.com](mailto:jeana.tahnk@auth0.com)


Auth0 Strengthens Leadership Team with Key Appointments

Former Auth0 Employee

Jon Gelsey

Company revenue grows 3x year-over-year as customer base extends across multiple industries. Auth0 will use the new funds to double down on security, extensibility and simplicity.



**BELLEVUE, WA** — (Marketwire, June 27, 2017) - [Auth0](https://auth0.com/about), the leading Identity as a Service platform, today announced it has raised $30 million in a Series C financing led by late-stage investor [Meritech Capital Partners](http://www.meritechcapital.com/) and that George Bischof, Managing Director at Meritech Capital Partners, has joined Auth0’s Board of Directors.  All existing major investors also participated, including Bessemer Venture Partners, Trinity Ventures, and K9 Ventures. NTT DOCOMO Ventures, Japan’s largest mobile carrier, and [Telstra Ventures](https://telstraventures.com/), the venture capital arm of Australia’s largest mobile carrier, participated as well, endorsing the easy-to-integrate enterprise scale platform that secures billions of logins every year. Auth0 will use the funds to further expand its geographic footprint, and to accelerate the growth of its identity platform with an increased subscriber and talent acquisition focus. 

“Identity has become even more mission critical as businesses become increasingly digital. In our dozens of calls with customers, it was clear that Auth0’s value proposition is resonating in the market. Developers can leverage Auth0’s extensible and easy to integrate identity platform and free up their cycles to work on the core application,” said George Bischof, Managing Director at Meritech Capital Partners. ”Auth0 subscriber adoption is exponentially expanding and we are excited to support their rapid growth.”

![Auth0 Board of Directors](https://images.ctfassets.net/23aumh6u8s0i/4Q2T2wz8ufCArbORCAeowl/3a9966211a214369b99e4baa258ebfe3/about-bod)

Funding comes as Auth0 caps off a yet another year of record growth, which saw revenue increase by nearly 3x year-over-year as the company added 1,250 new companies to its worldwide subscriber base across multiple industries. New customers include Atlassian (SaaS), News Corp (Media) and Houghton Mifflin Harcourt (Publishing). The company has also opened an office in London to serve the EMEA region, announced that it will open an office in Sydney, doubled employee headcount, and launched the [Auth0 Extend](https://auth0.com/extend/) product line, a new Serverless extensibility platform. The Series C funding will help Auth0 further extend its reach as an identity-as-a-service platform, offering deep identity security features, doubling down on simplicity and extensibility, as well as adding new features to the platform to better suit the needs of modern enterprises.

“At this time of constant threats and data breaches, modern enterprises require the strongest possible identity solution. Furthermore, in these new times, companies are racing to bring new products to market and facing both intense pressure to grow revenue and customers as well as fierce competition. They need to consolidate all their identity needs in one single end-to-end platform that works out of the box and can be easily extended to support all applications and use cases,” said Jon Gelsey, Auth0 CEO. “We are honored by the confidence placed in us by our investors, as well as by the trust displayed by our subscriber base as we seek to accelerate their business goals. Our subscribers are among the [most sophisticated enterprises](https://auth0.com/customers) in the world, and they continually drive and inspire us to create an even better set of services.”

Auth0 is an enterprise-grade platform for modern identity. It provides companies with a service that eliminates the complexity of authentication for applications and APIs, all accessible through a developer friendly dashboard. Their technology makes it easy to implement even the most complex identity solutions for their web, mobile, and internal applications and APIs.

<include src="asides/AboutAuth0" />

## About Meritech Capital Partners

Meritech Capital Partners is a leading provider of late-stage venture capital to category- defining private technology companies, and has been one of the top performing venture firms of the past decade. With over $3 billion under management, Meritech leads investments into companies with proven and differentiated technology, rapidly-growing revenue and experienced management teams. Meritech investments in industry-leading companies include Box, Cloudera, Cornerstone OnDemand, Coupa, Facebook, Fortinet, Mulesoft, NetSuite, Proofpoint, PopCap, Salesforce.com, Sourcefire, Tableau and Zulily. Meritech is located in Palo Alto, CA and can be found at [www.meritechcapital.com](http://www.meritechcapital.com). 

For more information visit [https://auth0.com](https://auth0.com) or follow [@auth0 on Twitter](https://twitter.com/auth0).


Cloud Identity Leader Auth0 Adds $30 Million Series C

From revenue to employee happiness, identity management has more to offer than you might think.



<div class="alert alert-info alert-icon">
  <i class="icon-budicon-500"></i>
  <strong>Forrester Consulting analysis determines that using Auth0 can yield a 548% ROI and $3.7M in identity-related savings. Read the full report: <a href="https://resources.auth0.com/forrester-tei-research-case-study/">Total Economic Impact of Auth0</a>.</strong>
</div>

---
[Identity management](https://resources.auth0.com/build-vs-buy-evaluating-identity-management/?utm_source=blog) seems like just a small piece of the puzzle that keeps your business running smoothly. If there's basic functionality for your system that gets people where they need to be, you should be all set, right?

Unfortunately, it isn't that simple.

Identity management is more than just being able to stick a username and password into a login box. It's very difficult to do right, and login will throw a wrench in the works if it's done wrong. But when you're committed to the best practices for login management, your business can benefit in ways you might not have realized.

And that's where outsourcing your identity management comes in. There are many reasons why your company needs identity and access management, but these five are a good place to start.

## 1. Attracting more users

If your business is [B2B](https://auth0.com/b2b-enterprise-identity-management) or [B2C](https://auth0.com/b2c-customer-identity-management), you're always thinking about attracting new users. Maybe you:

* Step up your game to craft some killer [ads for social media](https://adespresso.com/) and A/B test your ads with a platform like AdEspresso to get the best results from your ad budget.
* Reconfigure your onboarding process to help people realize the value of your product from their first session.
* Run extensive [mobile analytics](https://amplitude.com/mobile-analytics) for your new app to figure out exactly what you need to tweak to make it better.

But eventually just going through traditional channels like ads and analytics isn't enough.

One of the most effective, but oft-forgotten ways to drive conversions is simply to change login. User-friendly options like [single sign-on](https://auth0.com/docs/sso?utm_source=twitter&utm_medium=vc&utm_campaign=social_media_vids) and social login can make a big difference in how many people actually sign up — to the tune of a [20% increase in conversions](https://auth0.com/blog/how-to-use-social-login-to-drive-your-apps-growth/).

But then there's the daunting prospect of configuring across platforms for SSO and potential security concerns for social login. To create a [great login experience](https://auth0.com/blog/bad-login-experiences/?utm_source=twitter&utm_medium=sc&utm_campaign=bad_login) that converts users, you need a good identity and access management system (IAM).

With Auth0, you can implement frictionless sign-up options like social login almost instantly. Using an IAM system to implement a secure, user-friendly login is one of the most compelling changes you can make to convert a user.

## 2. Securing your data

Unfortunately, we can't even go a few months without hearing about [breaches of login information](http://www.telegraph.co.uk/news/2016/11/17/three-mobile-cyber-hack--six-million-customers-private-data-at-r/). As more companies implement an online or app presence and more consumers sign up for those accounts, the stakes of a security compromise only grow with each passing year.

The thought of having a problem with login security should strike fear into every business's heart, but it can be daunting to find the best way to implement a watertight login system.

Your business can't budget in an entire, 24/7 security detail, right?

![Protected](https://images.ctfassets.net/23aumh6u8s0i/5SbYF7rFfT2zgvbUIsouyM/bcb5c48692e7a62ed5f1c5c965746454/protected)

Well, no, you probably can't. However, when you outsource your identity management, you can get all the strength and expertise of your own security detail without keeping an army of engineers in your office.

From [encryption](https://auth0.com/security) to [password breach detection](https://auth0.com/blog/announcing-password-breach-detection/), your login will be as secure as possible when you outsource your identity management. *You *can't spend every second of every day making sure that your login is the most secure, but that is precisely what an IAM company does. That way, you can sleep at night knowing that you and your customer's data is safe and sound.

## 3. Supercharging your marketing

Selling and upselling your product means having a clear picture of your customers' interests, behaviors, and desires to [make marketing materials that really hook them in](https://auth0.com/blog/5-killer-email-strategies-for-lifecycle-marketing/).

The problem is that, more often than not, a customer's information is spread out over different platforms. You might have one platform for analytics, one for email messaging, one place where you store login information. Ultimately, the more you utilize customer information, the more platforms you'll have.

What you need is the ability to consolidate this information to create a powerful, information-rich profile. With Auth0, you can streamline the process of creating a profile by automating the transfer of information at login.

The easiest way to do this is with [Auth0 Rules](https://auth0.com/docs/rules): snippets of code that trigger at login with Auth0.

For example, you grab someone's profile information from their social login when they sign up. Then, you use a Rule to automatically enter that information into your platform of choice, say your email messaging platform. Easy as that, you've nailed that next happy birthday discount message.

![Flow](https://images.ctfassets.net/23aumh6u8s0i/6oo615rBK9J62Az9Ox7CHM/97617010b7803835cc1590c4904e98cc/flow)

## 4. Keeping up with the trends

Whether it's the latest social login or the latest security protocol, it's paramount that you keep up to date on the best login practices. You've got to be able to transition to the latest, greatest versions of login ([passwordless login](https://auth0.com/blog/analysis-of-passwordless-connections/), for example).

There's a lot of new technology, and much of it could radically change the way that we log in to everyday accounts and devices. Embracing the future of login means being prepared to use biometric data and increasingly integrated devices in a rapidly growing Internet of Things.

![Passwordless Authentication](https://images.ctfassets.net/23aumh6u8s0i/2H0rlvF7Yi3Yb2aVJ3hJ7n/5e543c41a0d1ddafca7b4bfd9c3bb89b/passwordless-authentication)

Staying on top of these shifting technologies is a [key to business (especially startup) success](https://auth0.com/blog/why-staying-agile-is-key-to-startup-success/) — unfortunately, it's also not usually your first priority when the bread and butter of your business isn't login.

This is why outsourcing your identity management can continue to return value to you in the long run. An IAM solution will be able to keep up with changes in social login, add relevant and novel features as they are adopted, and keep security on the cutting edge.

That means you can continuously update your login with almost no work on your end. You'll always be ahead of the login curve, giving customers confidence in your security and the newest, most convenient logins.

## 5. Making life easier for your company

Identity management can make a huge difference in the lives of your employees. When you have disparate systems that you need to connect to conduct your business, login can become a hassle.

If you're a smaller business, taking the time to sync up all of your systems to an easy login can be a difficult thing to do with limited time and resources. If you're a larger company, the number of employees you have to sync and the permissions you have to manage can be overwhelming.

And that's without even getting into [industry requirements](https://auth0.com/blog/how-real-state-companies-can-implement-open-id-connect-with-auth0/).

With Auth0, you can streamline your internal systems with a [single sign-on](https://auth0.com/learn/single-sign-on-in-3-steps/). This will allow your employees to get into all the systems they need with just one login and password, and to stay logged in across platforms throughout the day. That streamlines the process of getting work done.

![Single Sign On](https://images.ctfassets.net/23aumh6u8s0i/6WmLKH56p2FsypxTVlFRpI/9959cb0bb867ced64b168cf766afc0c5/bg-login)

A robust IAM system will also allow you to implement the correct permissions and add new accounts without having to think twice. Oh, and any industry requirements that crop up? Using an IAM solution takes the headaches out of adopting new protocols for your login if ever they come your way.

> Auth0 provides the simplest and easiest to use [user interface tools to help administrators manage user identities](https://auth0.com/user-management) including password resets, creating and provisioning, blocking and deleting users.

## Leave your login to the professionals

The best way to take full advantage of all that an IAM solution can offer you is to outsource your identity management. Unless you decide to sink your resources into building a full-scale identity management team, you simply won't be able to tap into the benefits that a robust IAM solution can offer you. Besides that, outsourcing identity management can help you increase productivity, collaboration, efficiency and security in your organization [through consolidated identity](https://auth0.com/b2e-identity-management-for-employees).

Identity management is more than a simple login. It can offer a real value to your business, for everything from employee quality of life to revenue generation, and it has the potential to be an integral component of your success.

[Learn how to evaluate a modern identity management solution that fits your needs in this free eBook, Build vs Buy: Guide to Evaluating IAM](https://resources.auth0.com/build-vs-buy-evaluating-identity-management/?utm_source=blog)


5 Reasons Your Company Needs Identity and Access Management

6 tips that will help you motivate your employees and increase your company morale



When startups die, it's not because they run out of money. It's not because they lose a key hire, and it's not because they fail to close on a big deal.

Startups die because they run out of morale.

<include src="TweetQuote" quoteText="Startups die because they run out of morale."/>

And the companies that make it through the hard times and come out stronger on the other end are not the ones with the best perks or the ones that pay the most. They're the ones where people feel deeply invested in their work, where they actually garner meaning out of it, where they're motivated to succeed by something intrinsic to them rather than externally imposed.

The only way to build a culture like that is to build meaning into the work that you and your team do everyday. Here are some practical ways to start doing that today.

## 1. Write Up A Mission Statement

When it comes to motivation, money isn't enough. Counter-intuitively, money actually seems to dampen our [intrinsic sense of motivation](https://hbr.org/2013/04/does-money-really-affect-motiv/). What builds it up, on the other hand, is the idea that you're pursuing a higher mission while you're at work.

It's really easy to say, "Well, I'm a B2B SaaS adtech company, so we can't have some fancy higher mission,” but companies in “boring” industries can have cultures that are just as powerful as any other company.

[Wistia](https://www.wistia.com/)'s a good example of a company that has built a mission-driven company out of an ostensibly boring field—business video hosting. They orient everything they do as a company around the idea of “[empowering everyone to get more out of video.](http://wistia.com/blog/mission-based-marketing)”

![Wistia Beach](https://images.ctfassets.net/23aumh6u8s0i/qwktL0uvgml5dSxT72eI7/08153829624822456edaee6057f12551/wistiaBeach)

(Source: [Wistia](http://wistia.com/library/lighting-on-the-fly))

That's why they make funny videos and air all kinds of internal antics on their company website: because they want to encourage people to get excited about video. They offer the *tool *companies can use to make better videos, but their *mission *is to help companies get more out of video as a whole. And this alignment of mission and core business objective is key.

First, zoom out from your product and put it in context. Is your product faster than the alternative? Is it more affordable, or more powerful? What is the larger purpose that your product can serve in a customer's life?

Once you figure that out, write it down and start brainstorming with your team to find ways you can fulfill that mission even better than you are right now.

## 2. Make Your Values Explicit

Get your team together and write down your company's values. Prioritize: if you value experimentation but also up-time, then you need to figure out how you're going to reconcile those two when they come into conflict.

Explicit, shared values are motivating because they bring everyone into alignment on the goals of the company. Without them, decisions wind up being made by the loudest or the most aggressive person.

When you're all on the same page, disagreements over major decisions will still happen. But the fact that you consult a shared set of values means that rather than vanishing or fading into resentment, every failure will be an opportunity to learn and get better. You'll learn more about each other and what you believe every single time you're forced to bump up against your values. You'll get better, and your work will get more meaningful.

Over time, this is how you build a company that feels like it knows what it's doing. When you have that, you give people something to feel motivated about.  

## 3. A Little Friendly Competition

There's nothing wrong with offering your employees a little incentive to go above and beyond.

Charles M. Schwab, the American steel magnate, once bred competition inside his factories by [tallying up the production numbers](http://www.businessinsider.com/how-charles-schwab-got-his-workers-to-produce-more-steel-2013-7?op=1) of both the day & night shifts, then writing them up on a wall in chalk. When the night crew started its shift and saw their last count bested by the day crew, they'd work super hard to try and best their colleagues.

It's easy to look at something like that and assume that it would reduce overall cohesion, lessening the chances of cross-team learning and sharing of information. That's why you can't just go hands-off after introducing competition. You have to watch over your teams like an umpire to make sure that no one's competitiveness gets the better of them.

Overall, though, a bit of friendly competition can actually do a lot to boost your company's overall cohesion and motivation. When you hire people who are goal-oriented and want to do great work, "gamifying" work in this way can be a hugely gratifying thing.

## 4. Involve People On The Highest Level

Early on, most startups embrace transparency wholeheartedly. Founders and CEOs hold regular meetings with their staff to talk about everything from major deals with new customers to finding new office space to financing. But when companies grow, that can easily come to an end.

Involving everyone at your company in major decisions is crucial to keeping a cohesive team that's motivated to succeed. It's hard for people to feel invested in a company they don't feel they have a part in building.

You need everyone to walk around the office "like they own the place," so make sure you solicit ideas and suggestions for things the company could be doing on a rolling basis. Hold meetings on a weekly or bi-weekly basis with your entire team to update them on the goings-on of the company. Get people to see that they're part-owners of your company.

![Auth0 involving people](https://images.ctfassets.net/23aumh6u8s0i/3UEFpY9vpgYtgerr4kzsw6/49455fdb1b9747829167c4dd5ebc4e18/auth0-meeting)

## 5. Create Psychological Safety

In his new book, Pulitzer Prize-winner Charles Duhigg explains how Google's long quest to figure out how great teams work finally concluded. Much to the surprise of Google's data-driven People team, it was found that the best teams were simply teams where everyone spoke for about the [same amount of time](http://www.nytimes.com/2016/02/28/magazine/what-google-learned-from-its-quest-to-build-the-perfect-team.html).

It sounds strange, but speaking time has big implications for actual workplace behavior. When great teams at Google held meetings, for instance, everyone had a chance to voice their opinion. No one person controlled the flow of any conversation.

What Google concluded from their study was that people needed to feel "psychologically safe" at work if they were going to perform up to their potential.

Encourage psychological safety in your workplace by instructing managers to pay special attention. During meetings, they should be focused on making sure that everyone gets a chance to talk. If people clam up, their manager should take an active role and find out what's going on.

## 6. Give Honest Critiques

Kimball Scott was still buzzing with excitement from giving her first presentation at Google when her boss, Sheryl Sandberg, pulled her aside.

She told Kimball a few of the things she liked about the presentation, said she was impressed by how well Kimball's team was doing, and then offered some advice. "When you say 'um' every third word," Sandberg said, "You sound stupid."

Kimball hadn't expected to receive such a blunt critique, It stung at first, but now she waves the banner of "[radical candor](http://firstround.com/review/radical-candor-the-surprising-secret-to-being-a-good-boss/)" and believes such straight-forwardness is the best thing a manager can give one of their employees.

![Employees Meeting Work Office](https://images.ctfassets.net/23aumh6u8s0i/58aYGyKTOtUuwS72KR8EsF/bc5856d8f918ddb8d603814109d4d76c/employees-meeting-work-office)

But this "radical candor" comes with a big caveat: your employees have to know that you legitimately care about them. Kimball knew that Sandberg legitimately wanted her to succeed. So get radically honest with your people, but make sure they know your heart's in the right place.

## Rethinking The "Way Things Are"

A ton of startups, when they first get off the ground, buck traditional corporate values and try to build a unique culture.

As they grow, however, that culture always gets harder and harder to maintain. Processes slip. People start to feel distanced, like they're losing touch with the company they helped build.

But no startup needs to submit to the “way things are.” Every single day is an opportunity to re-define the way things work. So if you're noticing a drop in motivation at your office, don't dismay. Startups are hard. Just do something about it.


How To Motivate Your Employees

We are going to extend the scenario described in the previous post, so Fabrikom can accept users from another partner company.

We are going to extend the scenario described in the [previous post](http://blog.auth0.com/2013/03/04/On-Premises-SharePoint-Federated-with-Office-365-and-Google/), so Fabrikom can accept users from another partner company. This time, their users will authenticate with an on-premises Active Directory.

![Federation Active Directory](https://images.ctfassets.net/23aumh6u8s0i/1fdbyoES9mKToT95lBHwrF/920d1492721f4cc0e965c6f1bf46a1d5/auth0-sp-O365-ad)



Again, with Auth0 this is very simple. Because Fabrikom's SharePoint is already configured to use Auth0, all it needs to do is add a new connection with its partner's AD.

This short demo shows:

-1. John, an employee from Fabrikam's partner company, logs-in into SharePoint with his credentials.
-2. Notice how "home realm discovery" works. John enters his e-mail address in __Auth0 Login Widget__. As with the previous example, Auth0 will extract the domain and map it to the right Fabrikom connection (Active Directory in this case).

<iframe width="700" height="525" src="https://www.youtube.com/embed/xmGjp1pLbVE?rel=0" frameborder="0" allowfullscreen></iframe>

A frequent question we get is whether the login experience is extensible and customizable.

The __Auth0 Login Widget__ is designed to get you going quickly and is fully customizable. And is optional. You have full control of the login process.

For example, Fabrikom is likely to have a URL for its own employees (who generally wouldn't need a selector) and a different URL for partners (who will likely need the selector). Another popular option is to use vanity URLs, or something like:

>https://thesharepoint.fabrikom.com/ThePartner

All this is very simple to achieve with Auth0.

Another frequent question we get is: can the connection between Fabrikom and its partners be automated?

The automated/self-service provisioning is demonstrated in this [post](http://blog.auth0.com/2012/02/28/SaaS-App-Federated-with-Office-365/), using __Auth0 Provisioning Widget__.

The __Auth0 Provisioning Widget__ is using Auth0 API under the hood to create a new connection.

> __A final note of this example:__ the connection to Active Directory is done here through ADFS (Active Directory Federation Services). We assume that the partner has deployed it already. But what if the don't have it?
Auth0 provides you with __Auth0 AD Connector__. A simple component your partner would deploy and you are done with minimal intrusiveness.

[Try Auth0 yourself!](https://auth0.com)

On-Premises SharePoint Federated with Partner AD

Auth0 is about making identity simple. And even simpler for the most common and recurrent scenarios. One such scenario is a company that is using SharePoint

Auth0 is about making identity simple. And even simpler for the most common and recurrent scenarios.

One such scenario is a company that is using __SharePoint on-premises__ and has moved e-mail to __Office365__. They might not yet be ready for using SharePoint in the cloud (e.g. don't have the time for a migration to the cloud, or need more advanced customization than what Office365 offers).

![SharePoint Federation](https://images.ctfassets.net/23aumh6u8s0i/6eR38qGF4BlzozrierXIuk/8e4b6f32c1ef4440ccf202fdc02f77d0/auth0-sp-O365-goog)

With Auth0 this is straight forward, as we support SharePoint out of the box. You simply need 2 lines of JavaScript to initiate login (using __Auth0 Login Widget__).



![](https://images.ctfassets.net/23aumh6u8s0i/xdbrKOhApW8rIC83La6dE/f9ea85c2d3ccba435d28ad6ac9273915/auth0-sp-login-widget)

This has an additonal benefit: now you can also open your SharePoint to other organizations that need to collaborate with you. You don't need to create or manage their credentials yourself anymore.

This short demo shows exactly this scenario:

-1. Tom, an employee in Fabrikom logs-in into SharePoint with his Office365 credentials.
-2. A partner of Fabrikom, logs in with his Gmail account.

<iframe width="700" height="525" src="https://www.youtube.com/embed/QXpjouNt9XM?rel=0" frameborder="0" allowfullscreen></iframe>

In the next post we will cover a natural extension of this first scenario: federating with a partner company using Active Directory.

[Try Auth0 yourself!](https://auth0.com)

"company"