Identity Plus utilizes mutually authenticated TLS (mTLS) to create a secure identity perimeter, ensuring that only verified clients can access services while blocking all unauthorized traffic. This approach reduces the attack surface by 99.99999%, significantly lowering the risk of cyber threats such as credential stuffing and DDoS attacks, while minimizing operational overhead for organizations.
Funding
Funding not disclosed
Founders
Product
Problem
Traditional security solutions rely on application-layer authentication methods like API keys, basic authentication, and tokens, which expose applications to vulnerabilities and create a large attack surface. This necessitates significant investment in security technologies, resources, and personnel, yet often proves insufficient against threats like zero-day exploits.
Solution
Identity Plus employs mutually authenticated TLS (mTLS) to establish a secure identity perimeter, ensuring only verified clients gain access to services while blocking unauthorized traffic at the connection level. By authenticating connections rather than application requests, Identity Plus effectively hides the application layer and its vulnerabilities from unknown entities, resulting in a substantial reduction in the attack surface. This approach eliminates the need for managing client certificates, simplifies deployment, and reduces operational overhead, while providing robust protection against various cyber threats.
Target Audience
Identity Plus targets organizations seeking to enhance their security posture, reduce their attack surface, and simplify identity management, including SaaS platforms, API gateway providers, mobile gateway operators, and enterprises adopting zero-trust architectures.
Features
- mTLS-based identity perimeter for connection-level authentication
- Single sign-on (SSO) simplicity for ease of use
- Elimination of dependencies between peers for scalable authentication of millions of clients
- Protection against application DDoS, credential stuffing, scraping, and zero-day attacks
- Compatibility with standard HTTPS/TLS protocol stack
- Integration with existing security infrastructure
- Support for role-based access control (RBAC)
- Device-level authentication for granular control