For CISOs · Identity Architects · Heads of Detection and Response
Stolen sessions authorize nothing. Push-bombing approves nothing. Insider denial proves nothing.
Continuous verification produces a token. Tokens get stolen, replayed, and bombed. Yuthent produces a gate the token cannot open: the privileged command does not execute unless the enrolled operator signed for it, or signed the boundary it falls inside.
The Problem
Zero Trust redefined the security posture. Never trust, always verify. In practice, verification reduces to session-level signals feeding into an access decision that produces a session token. The token then authorizes every action inside the session. An attacker who takes over the session through AiTM phishing, cookie theft, OAuth consent phishing, or browser-session compromise inherits the full access the session carried, instantly, with no further friction at any privileged action.
What Yuthent Provides
Stop protecting the session. Start proving the action.
Session takeover stops being a path to privilege escalation because the session holds no privilege. A stolen cookie used against a privileged endpoint reaches the gate and stops there. The verifier sees no proof and refuses the action.
For AI Agents
The agent can request the privileged action. Only the human can authorize it.
The operator signs the blast radius once
A mandate is signed on the accountable operator's own device: which command classes the agent may run, how many in a day, until when. Inside those bounds a service restart or a routine rotation proceeds without paging anyone at three in the morning.
Outside it, the operator signs the command
A secrets read, a production change, a policy edit, a bulk export past the ceiling: the call stops and a signed request reaches the accountable operator's device showing the exact command, target, and scope. A prompt-injected or compromised agent can request it and cannot produce the human's signature.
No mandate, no execution
If no mandate covers the agent, or the one it names has expired or been revoked, the call fails rather than falling back to whatever its OAuth token or service account still carries.
Attack Surface
Where Yuthent closes the gate.
MFA Fatigue and Push Bombing
The pattern
Attacker triggers repeated MFA push prompts, often late at night, until the target approves one out of exhaustion, confusion, or habit.
Why current defenses fail
Conventional push approvals are generic: a single 'Approve?' prompt with no binding to a specific command. Number-matching mitigates but does not eliminate the attack.
Where Yuthent stops it
On Android, no generic approve surface exists. Every Yuthent prompt carries the exact action parameters: the command, the target, the scope.
Insider Threat · Plausible-Deniability Exfiltration
The pattern
An authorized employee with legitimate access executes privileged actions or exfiltrates data. When detected, the employee claims their credentials were compromised.
Why current defenses fail
Access logs show the employee's account performing the action. SIEM and UEBA produce probabilistic indicators, not cryptographic proof of direct personal involvement.
Where Yuthent stops it
A compromised-credential defense fails because the proof requires physical device possession plus the enrolled biometric at the exact moment of action.
Capability Surface
What the SDK and control plane produce for your security stack.
Immediate revocation with push propagation
A compromised device revoked through the control plane propagates to the endpoint in real time. Exit requires full re-enrollment.
Webhook stream into SIEM and SOAR
Outbound events for every tiered action, every refusal, every trust-state change, every revocation. Delivered as JSON, CEF, or CEF wrapped in RFC 5424 syslog.
Regulatory Alignment
What each framework will not let you run without.
NIST SP 800-207 Zero Trust Architecture
Maps directly to the per-request authorization model at the heart of the framework.
Independent security validation (scheduled)
A gray-box penetration engagement is scheduled during deployment readiness with a 30-day retest on High-plus findings.
NIS2 and DORA
Operational-resilience frameworks require cryptographic evidence of privileged actions and defensible incident forensics.
Alongside Your Stack
Yuthent sits alongside your identity provider, your passkey or MFA layer, your PAM and your EDR. It replaces none of them. It adds an execution-time evidence layer beneath all of them.
Deployment Readiness
Deployments are paid engagements with a named integration scope, a defined threat-model objective, and a cryptographic evidence target. A deployment typically scopes one high-stakes operator surface: production console access, cloud control-plane operations, or secrets retrieval.
Questions
Answered plainly.
What if the agent or the session is compromised?
We assume it may be. Blocking the compromised agent inline is the job of runtime security tooling.
Where does enforcement sit so an insider can't switch it off?
At a point you control, the resource, a gateway, or your PAM, that calls Yuthent for the high-risk subset. Yuthent is the authority service, not an inline choke point the operator can bypass.
Does this help with cyber-insurance requirements?
Increasingly, yes. It does not replace your policy's control requirements, it converts several of them from attestations into demonstrable controls.
Does Yuthent see our data?
No. The control plane receives action metadata, the command and target hashed into the signature, a counter, a device attestation, and the proof, never the payload of the action or the data it touches.
See it on your own flow.
Your app, your call, our SDK.