Topic
Security Automation
Within the Topic facet, Security Automation topic intelligence connects articles that share a specific subject, signal focus, or monitoring theme. The page gives readers a richer path through related reporting, source evidence, market actors, and infrastructure implications, with enough context to understand why the topic matters across company movements, governance decisions, regional exposure, and operational risk. Readers can compare recurring signals, affected organisations, public evidence, market context, service continuity, procurement, competition, compliance, and strategic planning questions behind the subject instead of stopping at a thin list of matching articles. It explains what the topic covers, which infrastructure actors or policies are involved, what evidence supports the coverage, and why the subject may matter for operators, customers, investors, and policy readers.
CASE FILE
One Sequence Number Was Asked to Tell Two Histories: RFC 9721
EVPN can advertise a MAC address and an IP address together, then attach one number to say which reachability is newer. That bargain works until the two identities stop moving as a pair. RFC 9721 preserves the compact wire record, but only by creating a deeper operational duty…
IETF
BGP Found a Reachable Address. It Had Not Yet Measured the Path That Would Carry the Packet
A new IDR draft confronts a quiet error in modern routing: the address BGP can reach may not be the tunnel, policy or SID that will carry the traffic. Its answer is not another universal metric, but a stricter evidence boundary around each path-resolution decision.
IETF
The Action ID Stayed the Same. The Validator Did Not.
The latest CAID draft holds the digest steady for entities both revisions accept, yet explicitly refuses some action entities that could carry valid identifiers under the previous draft. For an audit trail, the missing fact is not another hash. It is which rules were used when an…
CASE FILE
The Name Was Allowed. Yesterday’s Address Blocked the Device: RFC 9726
A manufacturer can put the right service name in a MUD policy while a firewall enforces the wrong moment of that name. RFC 9726 exposes the hidden translation between DNS intent and packet rules—and why a clean policy file is not proof of a working or safe IoT device.
IETF
The Resolver Disclosed the Exception. It Did Not Authenticate the Answer
An emerging DNS signal can tell a client that a resolver suspended validation for a name. That is valuable candour. It is not a seal of truth, a defence of the operator's decision, or evidence that the application reached a safe service.
IETF
An Accepted AAuth Event Is Not an Agent's Decision
A new AAuth Events draft gives a resource an always-on place to send a signed event. Its `202 Accepted` response closes only the first hand-off: an agent may still be offline when the event's useful lifetime runs out.
IETF
The Parent Admitted the Boundary. It Did Not Promise a Road
A proposed DNS convention lets a public parent say that a child zone exists in another namespace while offering no public nameserver to reach it. The empty target is useful precisely because it is modest: it records a boundary without turning parent intent into proof of private…
IETF
Two Small Agent Budgets Can Authorize One Large Bill
An exploratory AAuth draft puts a hard ceiling on each agent token. The harder governance question sits one step upstream: who reserves against the person's total when several tokens are alive at once?
CASE FILE
The Signature Verified. The Resource Server Still Had a Decision to Make: RFC 9701
A signed token-introspection response can prove which authorization server issued a particular answer for a particular resource server. It cannot decide what that server should let a caller do now. RFC 9701 strengthens the receipt between two authorities; it does not merge them.
IETF
The Ladder Stayed in Cache. The Proof Still Had to Cross
SigTag proposes a smaller post-quantum DNSSEC response when a resolver says it already knows the signed Merkle Tree Ladder. That saves retransmission; it does not make cache state authoritative. The server’s omission, the resolver’s retained bytes, signer binding, validation…
IETF
A Valid Signature Is Not a Shared Trust Decision
An individual Internet-Draft on agent-action evidence has changed a deceptively small word in its evaluation model. The revised proposal asks a verifier to say separately whether an artifact checks out and whether this particular relying party is willing to rely on it.
IETF
The Certificate Shrunk. The Trust Decision Did Not
The Certificate Shrunk. The Trust Decision Did Not intelligence summary explains the development, the public evidence available to readers, the organisations involved, the regional context, market exposure, and the infrastructure consequences that may follow. The IETF…
CASE FILE
The File Was Routed to Haptic Hardware. That Does Not Mean the Effect Survived: RFC 9695
A media label reaches the one subsystem whose output can push back on the body. The registry can say where the entity belongs; only the endpoint can show what it understood, what it discarded, how it adapted the request, and whether the machine returned safely to rest.
IETF
The Hop That Changed Nothing Can Still Disappear
A revised WIMSE proposal draws a sharp line between evidence that a message changed and evidence that an intermediary was present at all. The second question matters most when the intermediary forwarded the request untouched.
CASE FILE
The Successor Key Waited 30 Days. The Validator Fleet Did Not Share One Clock: RFC 9691
Day 30 can arrive on an operator’s calendar while thousands of RPKI validators are still on day 12, day one, or no timer at all. RFC 9691 gives a trust anchor a careful way to stage a successor key; it does not turn a dispersed relying-party population into one synchronized…
IETF
The Certificate Was Good for the Number. The Call Still Needed a Decision
STIR’s new OCSP profile can make a narrow and valuable statement in real time: this certificate is still valid for this telephone number. The discipline begins where that statement ends. It does not certify the human speaker, the purpose of the call, the safety of the request or…
CASE FILE
The Certificate Carried the Key. It Did Not Carry the Recipient's Yes: RFC 9690
An RSA public key can be valid, correctly encoded and usable for familiar RSA operations while saying nothing about whether its owner will accept RSA-KEM today. RFC 9690 makes that separation unusually explicit. For an operator, the result is not a cryptographic footnote but a…
CASE FILE
The Proxy Joined the Path. It Did Not Join the Control Planes: RFC 9689
A legacy router can signal its half of an MPLS path while a controller programs the other half hop by hop. RFC 9689 shows how a PCECC proxy can make that migration path continuous. The dangerous shortcut is to let continuity erase the seam: one LSP may still contain two kinds of…
CASE FILE
The OID Was Right. One Missing NULL Changed the CMS Contract
Two systems can display the same friendly label—“RSA with SHA3-256”—and still disagree about the entity in front of them. RFC 9688 makes the reason unusually crisp: in CMS, the algorithm number is only one part of the wire contract, and the presence, absence or exact contents of…
IETF
HPKE's Successor Leaves Two Authenticated Modes with Its Predecessor
An IESG ballot now asks whether a new HPKE specification should replace RFC 9180. The replacement carries forward much of the scheme, but applications using the old sender-key authentication modes cannot treat a changed standards reference as a completed migration.