Mira Sharma

Mira is a Product Manager on Auth0’s Enterprise Federations team. She is passionate about building connections, whether they involve OIDC tokens, puzzling out the shape of new product features, or frustrating New York Times games. When she’s not working, she’s probably writing intergalactic stories, out on a run, or in a pool somewhere.


Product Manager

How Private Key JWT Client Authentication on OIDC and Okta Enterprise Connections does away with client secrets. 

Using a client secret to authenticate an application is a bit like writing your password on a sticky note and handing it to someone else. It works, but only if everyone who touches it is careful, no one ever copies it, and you remember to change it before anything goes wrong.

For years, that’s how systems authenticated with OpenID Connect (OIDC): using long-lived, reusable secrets shared between clients and identity providers (IdPs). But in today’s threat landscape&mdash;where secrets get logged, leaked, and left behind&mdash;that model just isn’t good enough.

Now, with **Private Key JWT Client Authentication for OIDC and Okta Enterprise Connections**, available in Early Access, Auth0 offers a more secure, standards-based alternative. Instead of passing shared secrets between systems, Auth0 signs short-lived JWTs with a private key on a per-request basis, enabling signature-based trust, built-in expiration, and no shared credentials.

Combined with existing support for [Private Key JWT authentication](https://auth0.com/blog/use-private-key-jwt-to-authenticate-dotnet-app/) from applications to Auth0, this release completes the picture: both direct login with Auth0 as the IdP and federated login flows can now have security without any client secrets.

### Why Client Secrets No Longer Cut It

Client secrets have been a default mechanism in OIDC authentication flows for years, but they come with serious limitations:

* **They’re static:** Secrets don’t expire unless someone rotates them manually. 
* **They’re symmetric:** Both the client and the IdP must store the same secret. 
* **They’re hard to secure at scale:** Especially in distributed architectures or across multi-tenant environments.

This model assumes a shared secret can be protected forever. But in practice, secrets leak through misconfigured pipelines, exposed logs, stale repositories, or over-permissioned vaults.

**Private Key JWT Client Authentication** addresses these limitations, specifically in the context of enterprise federated identity flows.

### What Private Key JWT Client Authentication Enables for Enterprise Connections

This release introduces support for JWT-based authentication from Auth0 to upstream identity providers in OIDC and Okta Workforce enterprise connections.

Instead of storing and sending a `client_secret`, Auth0 now enables developers to perform client authentication using a client assertion JWT signed with a per-connection private key. The upstream IdP verifies it using the corresponding public key.

Each JWT:

* Is generated dynamically per token request 
* Expires after 60 seconds or less 
* Includes a `jti` claim for replay protection 
* Is signed with a private key managed by Auth0

No static credentials. No shared secrets. No reuse.

This capability aligns with [RFC 7523](https://datatracker.ietf.org/doc/html/rfc7523) and is compatible with identity providers that support `private_key_jwt` as their token endpoint authentication method.

### A Fully Secretless Authentication Flow

This release introduces support for asymmetric JWT-based client authentication from Auth0 to upstream identity providers, complementing the [existing Private Key JWT support for authenticating applications to Auth0](https://auth0.com/docs/get-started/authentication-and-authorization-flow/authenticate-with-private-key-jwt). While each mechanism applies to a different type of login flow \- direct (app → Auth0) versus federated (Auth0 → IdP) \- together they let organizations eliminate client secrets on both sides of the authentication process. Whether between the app and Auth0 or between Auth0 and the enterprise IdP, authentication can now rely entirely on signed, short-lived JWTs.

![Side by side comparison](https://images.ctfassets.net/23aumh6u8s0i/6785eEfdKGSLr6gwQ1mBon/ff8eedc5cf2748f1c1a5d6b7255d3621/JWTCA_Blog.png)

Here’s a side-by-side comparison of how the two mechanisms work:

![Table with side by side comparison](https://images.ctfassets.net/23aumh6u8s0i/7FlJNHOkBvcRa3iP7fbbOe/c7d545c00fd5166deba4aa1ec3980be8/Screenshot_2025-06-25_at_1.01.09_PM.png)

### How It Works

Here’s what changes when you use Private Key JWT Client Authentication for enterprise connections:

1. A user authenticates via an enterprise IdP (e.g., Okta, Ping, ForgeRock). 
2. The IdP returns an authorization code to Auth0. 
3. Auth0 generates a signed JWT using the connection’s private key. 
4. Auth0 sends the JWT (as `client_assertion`) to the IdP’s token endpoint. 
5. The IdP verifies the signature using the registered public key (JWKS URI or inline). 
6. Tokens are issued \- no shared secret ever exchanged.

This is now available in Early Access for any custom OIDC or Okta Workforce connection configured to use Private Key JWT Client Authentication.

### Why Enterprises are Making the Switch

**Asymmetric Security and No Credential Sharing** 
JWTs are signed and short-lived; secrets never leave your environment. Public keys are published via JWKS, and there’s nothing to store, rotate, or accidentally leak.

**Compliance with High-Security IdPs** 
Some IdPs require signed JWTs — not secrets — for authorization code exchange. This feature facilitates integrations with these IdPs, enabling developers to work within policy or compliance constraints.

**Secure, Auditable Key Rotation** 
Keys are generated and stored more securely by Auth0 per connection. Rotation is supported through the Dashboard or Management API, and Auth0 supports multi-key publishing to avoid downtime during transitions.

### Learn More and Get Started

To learn more about how to configure Private Key JWT Client Authentication for enterprise connections, check out our [Early Access documentation](https://auth0.com/docs/authenticate/enterprise-connections/client-assertion-jwt).

Zero Trust Begins with Zero Shared Secrets

Jeremie Berthiaume jpg

Group Product Marketing Manager

Jeremie Berthiaume

Learn how Auth0 and Amazon Web Services can enhance fan engagement for sports organizations.



> The one aspect of your tech stack that can transform your fan experiences for the better.

Fans are the heart and soul of every sporting occasion. They make sport possible. Their loyalty goes far beyond attending matches. Fans expect a seamless experience, whether they’re trying to buy tickets or engaging with online content.


To make that happen, sporting organizations must integrate their platforms, apps, and websites to provide secure access and personalized experiences to their fans. Achieving this level of personalization and convenience might seem difficult, but managing your digital identity doesn't have to be.

## Why Is Identity so Important for Sports Organizations?

Simply put, digital identity is the foundation of fan engagement in today’s connected world. It defines how easily — or not — fans can interact with your organization and influences their overall experience. 

Fans will go to great lengths to follow their favorite teams and clubs. It’s our job to make it easy for them to support and engage. Your fans don’t want to juggle multiple passwords or log in repeatedly just to buy tickets or stream matches. 

They also expect personalized experiences that reflect their interests and past interactions. This is where a unified digital identity becomes crucial.

### Building better experiences

A unified identity platform brings together data from multiple touchpoints, creating a single, clear picture of each fan. 

Armed with these insights, sports clubs can offer tailored promotions, targeted content, and personalized offers. The net result is enhanced fan experiences and increased loyalty.

### Scalability is another major advantage

Sports events can cause significant spikes in digital traffic — think of ticket sales for a major game or demand for merchandise after a championship win. A robust digital identity system effortlessly scales, ensuring platforms remain reliable and responsive even under heavy traffic conditions. This prevents frustrating downtime or slow-loading systems.

## A Team of Two: Auth0 and Amazon Web Services

Auth0, the customer Identity platform, and Amazon Web Services (AWS) offer sports organizations a powerful, scalable solution.Auth0 brings the identity building blocks: secure, seamless identity management that’s ideal for handling millions of fans, members, and partners. AWS hits big with unmatched cloud infrastructure for performance, reliability, and global reach. 

Together, they enable clubs to personalize fan experiences, protect sensitive data, and rapidly scale during peak events like match days or ticket launches. With built-in compliance and flexible integrations, Auth0 and AWS make it easier for clubs to innovate faster, stay secure, and deliver world-class digital experiences.

### What Auth0 and AWS bring to the sports sector — and your organization

#### Develop seamless digital experiences

Auth0 provides an identity management solution perfectly tailored to the sports industry. Its key strengths include seamless fan login through single sign-on (SSO), integrated social logins, and even passwordless authentication methods, making access swift and simple. AWS brings global capacity, offering a scalable architecture that lets you deal with sudden and unexpected spikes in demand.

Downtime means lost business. Uptime is all part of the seamless experience for fans.

- One login for all fan services (e.g., apps, ticketing, merchandise, streaming).
- Simplified access reduces frustration and increases engagement.

#### Increased personalization at scale

- Tailor content, offers, and recommendations based on fan data.
- Unified Identity enables consistent, engaging experiences across channels.

Teams running on our platform can send fans offers for merchandise featuring the customer’s favorite players, personalized discounts on match tickets based on their past attendance, or early access to exclusive content. With an embedded authentication token, fans don’t have to sign in again to reduce friction. 

For example, the food delivery company Hello Fresh has increased its re-subscription rate by embedding a short-lived access token into email links. These meaningful interactions make fans feel valued, driving stronger connections and increased engagement. 

Auth0 helps you achieve it by using a single, secure login credential for each fan. This helps you analyze behaviors and personalize content. AWS helps increase personalization opportunities by providing advanced machine learning and analytics services like Amazon Personalize, which processes customer data in real time to generate hyper-targeted recommendations and predictive insights across multiple engagement channels.

Tap into new revenue streams with Auth0 by leveraging data to boost ticket and merchandise sales, drive more effective advertising and sponsorships, enhance digital and in-app purchases, and launch high-value subscription models with exclusive content and memberships. 

#### New revenue streams include

- Drive ticket and merch sales with personalized promotions.
- Enable subscription models and exclusive content access.

AWS provides access to Amazon Bedrock to help analyze customer behavior, from data collection and preparation to sentiment analysis, behavior pattern recognition, and advanced customer insights. Amazon Bedrock's powerful AI capabilities help you transform raw customer data into actionable, intelligent insights that drive strategic decision-making.

#### Stronger security and compliance

* Protects fans and your organization before, during, and after login.
* Supports GDPR and other compliance needs with centralized identity control.

Over 80% of data breaches involve compromised identity. Auth0 protects fan information with strong encryption and advanced security features like multi-factor authentication with Passkeys and bot protection. These features are essential during high-demand moments like major match days or merchandise launches. 

By consolidating identities and simplifying login processes, organizations reduce the risk associated with multiple passwords, enhancing security and streamlining the user experience. Auth0 and AWS work together to provide a multi-layered approach to threat detection and response, including AWS Web Application Firewall and GuardDuty for wider threat intelligence and faster response. Amazon API Gateway and Auth0 protect your applications from distributed denial of service attacks by enabling rate-limited authentication and authorization enforcement.

#### Proven results

- The Royal Belgian Football Association migrated 700,000 fan identities in four months.
- AWS technologies underpin projects for F1, The PGA Tour, and more.

Sports organizations that have adopted Auth0 and AWS see tangible results. For example, AWS works with major sports organizations around the world, including [F1](https://www.aboutamazon.co.uk/aws-f1-british-grand-prix-silverstone), [the PGA Tour](https://aws.amazon.com/solutions/case-studies/pga-tour-ecs-case-study/), and [the NFL](https://aws.amazon.com/blogs/media/inside-the-nfls-innovative-fan-data-platform-powered-by-aws/), helping deliver standout digital experiences to millions of fans. Auth0 has recently helped the Royal Belgian Football Association migrate 700,000 fan identities onto a unified platform, simplifying user management and bringing personalized experiences to fans.

### A home run for sports teams

Thankfully, integrating Auth0 and AWS is easy. Auth0’s cloud-based model and easy integration capabilities with existing platforms like CRMs, marketing tools, and fan engagement software. This integration allows clubs to focus on delivering great experiences rather than managing complicated systems.

Ultimately, providing a superior fan experience goes beyond match day. It’s about maintaining continuous engagement, delivering meaningful interactions, and securing fan loyalty through personalized, secure digital journeys. 

By leveraging Auth0 and AWS, sports organizations can achieve:

- Personalized fan experiences
- Increased revenue streams 
- Better security and compliance

In the fast-paced digital landscape of sports, fan identity management is the cornerstone of an exceptional fan experience. You know better than anyone that it’s about connecting with supporters in ways that matter, turning fans into lifelong advocates, and driving real, sustainable business growth.

Auth0 and Amazon Web Services: The Secret Ingredients That Drive Fan Engagement

jimena-garbarino

Jimena is an experienced result and value-oriented programmer with a strong engineering background. She excels with Ruby on Rails, Java, and Scrum development. She has worked in web development for 10+ years in many industries and has a master's degree in software engineering from Universidad de Buenos Aires.

Spring Cloud Developer

Jimena Garbarino

Storing secrets in your code is a bad idea. Learn how to use Spring Cloud Config and HashiCorp Vault to make your app more secure.

Secure Secrets with Spring Cloud Config and Vault

deepu-sasidharan

Deepu is a polyglot developer, Java Champion, and OSS aficionado. He mainly works with Java, JS, Rust, and Golang. He co-leads JHipster and created the JDL Studio and KDash. He's a Principal Developer Advocate at Okta. He is also an international speaker and a published author.

Principal Developer Advocate

Deepu K Sasidharan

Learn how to setup secure secrets on Kubernetes using Sealed Secrets, External Secrets Operator, and Secrets Store CSI driver.

Shhhh... Kubernetes Secrets Are Not Really Secret!

andrea-chiarelli

I have over 20 years of experience as a software engineer and technical author. Throughout my career, I've used several programming languages and technologies for the projects I was involved in, ranging from C# to JavaScript, ASP.NET to Node.js, Angular to React, SOAP to REST APIs, etc.

In the last few years, I've been focusing on simplifying the developer experience with Identity and related topics, especially in the .NET ecosystem.

Andrea Chiarelli

Learn the best practices to store and manage secrets in your .NET applications.

Secrets Management in .NET Applications

Daniel Krzyczkowski

Founder of Tech Mind Factory. Works as a Cloud & Identity Engineer, helping organizations design, build, and deploy modern identity solutions and secure cloud applications.



Tech Mind Factory

How to securely access secrets stored in the Azure Key Vault service using the new Azure SDK and managed identities.

Secrets Access with Managed Identities in .NET Applications

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

Enable your upmarket strategy with the right technical infrastructure

Enterprise customers are demanding.

Long sales cycles, filled with requests for custom features and integrations, can monopolize your developers and your sales team. If a contract falls through, a lot of time and money will fall through with it.

But the [_move upmarket_](https://auth0.com/blog/how-to-go-upmarket-and-grow-your-revenue-by-20x/) doesn't need to be such a struggle. If you're willing to slightly alter your sales strategy, you can quickly impress new clients and close enterprise deals.

Enterprise clients present three primary challenges to growing B2B companies:

1. **Legacy technology stacks**: Enterprises prioritize stability and often favor products from companies that have long histories in their industries.
2. **Intensive security demands**: Enterprises handle large volumes of data that make security breaches especially risky.
3. **Unique needs**: Enterprises have numerous stakeholders who need to be satisfied, some of whom will demand simplicity and others customization.

With Auth0's [_B2B federation_](https://auth0.com/b2b-enterprise-identity-management/), you can shorten the sales cycle with compatible infrastructure, ensure that the connections between your product and their employees are secure, and address their unique needs with custom configurations.

![Auth0 helps B2B companies grow](https://images.ctfassets.net/23aumh6u8s0i/76cbcjek9FIZY6nxQmvdZR/f0a096097a955ecfb53f099394e91092/b2b_1)

## Offer Compatibility Options to Shorten Your Sales Cycles with Enterprise Customers

The bigger an organization gets, the more internal and third-party tools — all potentially built on different stacks with different protocols — are likely to be in use. The person you're initially selling to might not even know all the infrastructure complications lying in wait.

A primary example is identity and access management (IAM) providers. Your ability to integrate with whichever provider your customers use can drastically shorten or lengthen the sales cycle. If they use Active Directory (and _[hundreds of thousands do](https://auth0.com/blog/analysis-of-enterprise-connections-data/)_), you'll need to implement that before you can close the deal.

If you let the sales cycle stretch out (already _[estimated at 3-6 months](https://saasmetrics.co/benchmark-for-b2b-saas-sales-cycles/)_ for deals that exceed \$100,000 in annual contract value), your internal advocate might move to a different position or company, or the benefits of your initial pitch might not remain relevant. Meanwhile, you might be losing out on other opportunities as you pay expensive developers to make your back end work with theirs.

Worse, if your next customer has a different back end, you'll have to do it all over again.

Auth0 offers B2B federation that _[integrates with 10+ IAM providers](https://auth0.com/blog/how-enterprise-federation-helps-shorten-the-sales-cycle/)_. With a few lines of code, you can configure any enterprise connection, including Active Directory, LDAP, ADFS, SAML, and more.

![Auth0 enterprise connections](https://images.ctfassets.net/23aumh6u8s0i/6HTuHDmDrVhGoM64N5W5VT/fbf838da10673560329d5dfcd92070f3/why-federation-is-your-secret-weapon-for-enterprise_auth0-enterprise-connections)

B2B federation provides the technical compatibility that makes your product more trustworthy and easier to use. By configuring your app with Auth0, you effectively configure it for numerous providers at once.

A sustainable [_enterprise sales strategy_](https://sapphireventures.com/oiling-the-enterprise-it-sales-engine/) builds from one company to the next, so you don't need to start over each time.

<include src="TweetQuote" quoteText="Auth0 offers B2B federation that integrates with 10+ IAM providers. Active Directory, LDAP, ADFS, SAML? Bring it on!"/>

## Show Enterprise Customers They Can Trust You

High-profile [_data breaches_](https://auth0.com/blog/what-is-a-data-breach/) have made enterprises increasingly risk-averse. To a wary enterprise, another partnership might seem like another vulnerability. New products, though they might be valuable, risk widening an enterprise's attack surface.

Enterprises are more likely than SMBs to have security and compliance teams that will take a critical look at your product. These teams need more than assurance. Their input for your service-level agreements will go beyond up-times and scalability and into strict security parameters and compliance standards.

If you provide federation through Auth0, however, maintaining security and compliance in the authentication process is much easier. Auth0 combines the simplicity of a federated identity provider with customizable security features. Your customers can enable tools like multi-factor authentication (MFA) and reinforce compliance procedures as necessary.

![Auth0 multi-factor authentication](https://images.ctfassets.net/23aumh6u8s0i/5zHCdntb8UHVwFG6QBnhd4/2b9f2ba4cfbcab1461b35f82e76d4e8c/why-federation-is-your-secret-weapon-for-enterprise_auth0-multi-factor-authentication)

With MFA, your enterprise clients know that access to sensitive materials won't be granted to anyone with a username and password. Despite these barriers to malicious access, administrators can approve requests easily across a variety of devices.

Guardian, Auth0's MFA application, also provides Mobile SDKs for [_iOS_](https://auth0.com/docs/multifactor-authentication/developer/libraries/ios) and [_Android_](https://auth0.com/docs/multifactor-authentication/developer/libraries/android) that enable you to build a white-labeled MFA application that matches a customer's branding.

Auth0 is compliant with a [_wide range of security, privacy, and compliance standards_](https://auth0.com/security/), such as HIPAA BAA, SOC 2 Type II, and PCI DSS, so you can demonstrate an understanding of your customer's industry-specific needs.

If you're competing with other products that have similar value propositions, the trust you build with enterprise customers can tip a decision in your favor. With Auth0 backing you, it's easier to address concerns from security and compliance teams. The faster and better you can satisfy these stakeholders, the closer you can get to completing a deal.

<include src="TweetQuote" quoteText="Auth0 is compliant with a wide range of security, privacy, and compliance standards such as HIPAA BAA, SOC 2 Type II, and PCI DSS that lets you cover your customer's industry-specific needs."/>

## Sell across Organizations with Single Sign on and Customization

Selling to an enterprise requires selling across levels and [_pleasing different parties_](https://www.copper.com/blog/enterprise-sales-prospecting). Your point of contact might be excited by the core value proposition, but the project managers might be worried about its execution. If all decision-makers aren't in agreement, a deal months in the making can fall apart.

Authentication can be a significant hurdle. IT staff, for example, might resist a new product if it threatens to increase their account-management workloads. Other stakeholders might resist the sheer addition of more credentials to memorize.

Single sign-on (SSO) can dispatch these concerns. With Auth0, employees will only have to enter their credentials once.

![Auth0 single sign-on](https://images.ctfassets.net/23aumh6u8s0i/51MTEF6y286lEpPFiuWMMC/5b67cb0f5643bb655fe06ddf981240cc/why-federation-is-your-secret-weapon-for-enterprise_auth0-single-sign-on)

Enterprises have a higher volume of users and tools, so the ability to sign on once is compelling.

Safari, a company that provides access for corporate learning materials, [_leveraged Auth0's SSO capabilities_](https://auth0.com/learn/safari-case-study/) to expand to enterprise customers. SSO cut support calls for account management without Safari having to dedicate specialized resources. They have since added numerous enterprise customers, differentiating their offering with easy authentication across desktop and mobile devices.

If you need to make integration and usage even smoother, Auth0 also provides customizable _[Rules](https://auth0.com/docs/rules)_. With this customization engine, you can make unique authentication and authorization stages for the customers that need it.

You can use Rules to assist migration by reusing information from existing databases, maintain a white list for particular users, notify systems of login attempts, and more.

## Moving Upmarket Requires a Renewed Strategy

Moving upmarket is more complicated than aiming your sales team at a different target. While you might be able to [_validate product/market fit_](https://www.intercom.com/blog/podcasts/the-myths-of-product-market-fit/) with smaller companies first, moving to enterprise clients requires significant planning.

Moving too fast can threaten your stability. A big contract might seem like a win at first, but without a [diverse customer base](https://www.inc.com/magazine/201606/jason-fried/saying-no-to-large-enterprise-customers.html), too much of your sustainability might hinge on a single large customer. If you shift your business to serve only a few clients, then your future belongs to those contracts—and that's a position no one wants to be in.

Closing deals with enterprise customers means closing the gap between a legacy provider's track record and your ability to meet the needs of your customer. The better you can tailor your product to their needs, the more you'll be able to _[shorten the sales cycle](https://blog.getbase.com/3-hurdles-slowing-sales-cycle)_ and build more valuable relationships for the long-run.

<include src="asides/AboutAuth0" />

Why Federation Is Your Secret Weapon for Enterprise

df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing. Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

We offer three tactics to create a more open and secure company — for your colleagues and end users.

->![Two people shaking hands in office environment](https://images.ctfassets.net/23aumh6u8s0i/2brFbaENwm1v0BO1alPzES/378e13d35486ac61232cdb192e0f3d15/shaking-hands)<-

[_Image via Pexels_](https://www.pexels.com/photo/achievement-adult-agreement-arms-1243521/)

Cybersecurity can be a black box. If you aren’t a software engineer, it’s almost impossible to figure out what’s happening behind the scenes to reduce threats and protect data.

And even if you are an expert, the multitude of changes, threats, and solutions can be dizzying.

None of this is helped by the fact that most companies choose to remain tight-lipped about what cybersecurity measures they have in place. In some ways, that makes sense: publicizing too much about your efforts could decrease your competitive edge and make you vulnerable to more attacks.

On the other hand, an intense level of secrecy about cybersecurity can be crippling. Knowledge-sharing throughout the industry is limited, and your customers can feel as though they’re left in the dark about what’s being done to protect their private information.

As a result, certain companies are opting to increase their transparency and disclose their cybersecurity practices. This piece will highlight the main drivers of change — and offer concrete solutions for business leaders to clarify their cybersecurity practices in a valuable manner.

## A Growing Push for Transparency

Pioneering regulations, as well as thoughtful business leaders, are catalyzing transparency initiatives. 

In February 2018, for example, the U.S. Securities and Exchange Commission [published an update](https://www.techrepublic.com/article/sec-will-now-require-us-companies-to-disclose-cybersecurity-risks-and-breaches/) to their 2011 cybersecurity statement. The update states that all publicly traded companies must "take all required actions to inform investors about material cybersecurity risks and incidents in a timely fashion." In addition, the National Conference of State Legislatures [reports](http://www.ncsl.org/research/telecommunications-and-information-technology/data-security-laws.aspx) that at least 24 different states have introduced laws related to the data security practices of private companies. 

In the UK, the [National Cyber Security Centre](https://www.irishtimes.com/topics/topics-7.1213540?article=true&tag_organisation=National+Cyber+Security+Centre) (NCSC) is pushing for [“more openness and demystification” around cybersecurity practices](https://www.irishtimes.com/business/technology/less-fear-and-more-transparency-key-to-fighting-cybercrime-1.3692135). This encompasses the work that the NCSC does with EU multinational companies.

For all companies that handle the data of EU citizens, regardless of their physical location, GDPR [requires](https://gdpr-info.eu/art-12-gdpr/) controllers to communicate about their data processing methods in “transparent, intelligible and easily accessible form, using clear and plain language.” 

Along with these external pressures, leaders within organizations are pushing for change. Microsoft’s Cybersecurity Field CTO Diana Kelley is [developing the company's Trust Center,](https://www.techrepublic.com/article/microsofts-security-tactics-focus-on-customers-transparency-and-working-with-its-tech-competitors/) which clearly articulates for customers how Microsoft uses and secures their information. Microsoft shares its progress on data security at an annual meetup with peers like IBM, Netflix, and Facebook.

As national and global regulations — as well as peer pressure — heat up, it's imperative for teams to have a plan in place for intelligently sharing their cybersecurity practices.

## 3 Ways You Can Increase Your Team's Transparency (and Bolster Your Security)

While a handful of teams are vocal and forthcoming about cybersecurity measures, it still isn’t second nature for many. Here are three ways to increase your own transparency and bridge those trust gaps inside and outside your organization. 

### 1. STRENGTHEN EMPLOYEE TRAINING.

->![Board meeting and presentation in office environment](https://images.ctfassets.net/23aumh6u8s0i/6LSX6AUWhE4xE1cr9L1vWw/40d3e18f90887e5f1a79339704b4e720/board-meeting)<-

[_Image via Pexels_](https://www.pexels.com/photo/group-of-people-sitting-near-table-1181396/)

Remember, not everybody within your organization is a cybersecurity expert. According to the [University of Phoenix](https://www.phoenix.edu/about_us/media-center/news/uopx-survey-perceptions-cybersecurity.html), just 10% of U.S. adults are familiar with common cybersecurity job titles (e.g., penetration tester or chief information security officer). 52% of the survey’s respondents had never even heard of the titles.

True transparency isn’t just about giving people information; it’s also about ensuring that they understand it. Internally, you need to invest in thorough training across all departments so that employees are fully aware of what to watch out for and how to protect themselves.

While your colleagues are your greatest assets, they can also be your biggest liabilities when it comes to cybersecurity. In 2018, a [Positive Technologies study](https://www.techrepublic.com/article/dont-skimp-on-it-security-training-27-of-employees-fall-prey-to-phishing-attacks/) of 3,332 employees found that 27% of participants clicked on test emails with phishing links. With the 2018 cost of a data breach on the rise — ticking in at [$3.68 million](https://www.ibm.com/security/data-breach) (up 6.4% from 2017) — it’s critical that everyone on your team recognizes threats and has resources to immediately report incidents.

### 2. DEVELOP A DETAILED PROCESS FOR HOW YOU'LL DISCLOSE BREACHES.

Nobody likes to dwell on cybersecurity incidents actually happening, but it’s essential that you have a process in place for how and when you’ll [disclose a breach](https://auth0.com/blog/what-is-a-data-breach/) if it does occur. Ironing out this process now allows you to be more proactive and move forward in a timely manner. In particular, if you handle the data of EU citizens, you have just 72 hours to report a breach, [according to GDPR's new deadline](https://gdpr-info.eu/art-33-gdpr/).

Timing can be a delicate balancing act. While you don’t want to act too quickly and disclose a breach before you have all of the necessary details, waiting too long to make the event known can expose you to criticism. Public trust in [T-Mobile](https://auth0.com/blog/3-critical-lessons-from-the-t-mobile-data-breach/), [Equifax](https://money.cnn.com/2017/09/08/technology/equifax-hack-disclosure/index.html), and [the German government](https://www.telegraph.co.uk/news/2019/01/04/hundreds-german-politicians-hacked-massive-data-leak/)(to name a few) declined following delayed disclosure of data exposures.

If you don’t already have clear protocols for disclosure, it’s time to create them. Consider including:

* A deadline for when internal and external stakeholders will be made aware of the event
* What information you will share with the different parties
* Incorporating language that empowers users to take security into their own hands

As we highlighted in our prior dissection of the [Reddit data breach](https://auth0.com/blog/what-companies-can-learn-from-the-reddit-data-breach/), you can return power to users who are in a situation where they feel like victims by laying out the steps they can take to protect their personal information.

->![Reddit Data Breach notice to users regarding 2FA and other security measures](https://images.ctfassets.net/23aumh6u8s0i/77n70IUdObd3KDLcqbQEWF/b120ee596c3faf6b6c914b6ae5fdac9d/reddit-data-breach)<-

[_Image Source: Reddit_](https://www.reddit.com/r/announcements/comments/93qnm5/we_had_a_security_incident_heres_what_you_need_to/?st=jkk18vb3&sh=ad92bacb)

While it might make you uneasy to be so upfront about your vulnerabilities, if you communicate the issue correctly, you can turn the risk into an asset by retaining and even bolstering user trust. 

### 3. IMPLEMENT A STRONGER USER MANAGEMENT SYSTEM.

One of the biggest barriers to transparency in corporate cybersecurity is that, even for IT staff, it can be difficult to understand who is working within their system. With a range of permissions granted to customers, employees, and third parties, such as consultants — it's easy to lose track of your users.

Implementing a system like [Auth0](https://auth0.com/) can help you keep all of your users at a given time in one central view. 

->![Auth0 Dashboard view](https://images.ctfassets.net/23aumh6u8s0i/01LwCh4Yy7Tk0LdhNxgxG8/7d2a6efdfb8b4c12093076b1e00b5140/auth0-dashboard)<-

Here, admins can monitor login activity, compare it with activity over time, and quickly note and take action on any unusual behaviors like multiple failed login attempts. Having a clear record improves your ability to demonstrate your practices both internally and externally.

## More Transparency Leads to Better Security

When talking about cybersecurity, it’s usually new technologies that get the majority of the spotlight. Yet simple fixes, like increasing your level of transparency, is are also fundamental to progress. If implemented correctly, transparency practices can lead to improved security and, as an added bonus, increased trust with your stakeholders. 

[Working with Auth0](https://auth0.com/) is one way that teams choose to boost their knowledge and ability to share information about cybersecurity. Auth0 is a trusted partner with thousands of enterprise customers across industries, giving teams and their end users added peace of mind in turbulent times.

<include src="asides/AboutAuth0" />

"secret"