SecureAuth is an identity security company that handles authentication and authorisation for employees, customers, business partners and, more recently, AI agents. Its focus is on deciding whether each action should be allowed, not only whether a user should be let in at login, and it treats identity as the control plane for that decision.
It serves federal agencies, financial institutions, healthcare organisations and global retailers, where a stolen session or a misused agent can move money or expose regulated data.
At A Glance
| Vendor | SecureAuth |
|---|---|
| Category | Workforce IAM, MFA and passwordless |
| Identities covered | Workforce, customer, B2B and AI agent identities |
| Deployment | Cloud and hybrid, with support for air-gapped IAM |
| Agentic AI | Agent Authority Platform, Agent Trust Registry |
| Customers | Deda Sphere, Routeware, Transcom, AARP, Nissan |
| Market classification | Workforce IAM; also MFA & Passwordless |
What SecureAuth Does
A successful login proves who someone is at one moment. It says nothing about whether the payment, data export or tool call that follows should go ahead. CEO Geoffrey Mattson puts it this way: “Authentication tells you who walked in the door” but “tells you nothing about whether the next transaction should happen.”
SecureAuth’s answer is continuous, per-action authorisation across workforce, customer and agentic identities. Identity is re-checked throughout a session rather than once at the door, and the same model applies whether the actor is a person, a service or an AI agent.
Products
Agent Authority
Agent Authority is for organisations that are putting AI agents into production and need to know what those agents are doing and on whose behalf. It discovers agents, controls what they can reach and enforces policy as they run. Its modules are MCP Authority, LLM Authority and Endpoint Authority, an NHI Inventory, Agent Threats & Findings, and Compliance & Risk Assessments.
Workforce, Customer And B2B Authority
These products cover sign-in and access for employees, consumers and business partners. They are built on open standards, including OAuth 2.1 and OpenID Connect, and combine a risk engine with fine-grained authorisation, so a bank or retailer can apply stronger checks only where the risk justifies it.
Assurance And Presence Authority
Assurance and Presence Authority keep checking that the right person is still present after login. Biometric Continuous Identity Assurance (BCIA) and continuous risk monitoring help organisations with remote or sensitive work, such as staff handling regulated data, confirm the session has not changed hands.
Arculix
Arculix is SecureAuth’s earlier passwordless and access management platform. Its Orchestration Engine lets teams connect and deploy identity services through a no-code interface, continuous authentication keeps re-evaluating a user’s level of assurance, and a mobile device can act as a FIDO2 certified authenticator.
Microperimeter Authorizer
The Microperimeter Authorizer is aimed at the non-human side of the estate. It extends Zero Trust controls to software agents, services and automated workflows, so machine-to-machine actions are authorised in the same way as human ones.
Agent Trust Registry
The Agent Trust Registry is an open registry of AI agents carrying verified identity, trust scores and governance metadata. It helps organisations judge an agent before connecting it, by evaluating identity, behaviour, access and governance.
How It Works
SecureAuth runs in cloud and hybrid environments and sits between identities and the systems they act on.
| Component | What it does |
|---|---|
| Per action evaluation | Each API call, tool invocation and transaction is checked against identity, policy and risk, and can be blocked, downscoped or escalated. |
| Credential federation | Credentials are federated across OAuth 2.0, OIDC and mTLS through a unified vault, so “agents never see a downstream secret”, and no standing privileges are granted. |
| Audit trail | All capabilities write to one identity-anchored audit trail that can be exported for regulators or streamed to a SIEM. |
| Integration model | Agent Authority works with the identity provider an organisation already has and needs no code changes or commitment to a single AI model. |
Identities And Systems Covered
| Workforce users | Employees through Workforce Authority |
|---|---|
| Customers and partners | Consumers and business users through Customer Authority and B2B Authority |
| AI agents | Discovery, delegated access and runtime control through Agent Authority |
| Non-human identities | An NHI Inventory, plus software agents, services and automated workflows |
| Environments | Cloud, hybrid and air-gapped deployments |
Agentic AI Capabilities
Runtime Control For Agents
The Agent Authority Platform authorises each agent action in real time based on who, what, when, where and how much. Runtime decisions are Allow, Deny, Redact, Throttle, Escalate or Human approval. Every agent action is attributed live to a human user and a business purpose.
Agent Detection And Response
Agent Detection and Response (ADR) builds a behavioural baseline for each agent and flags drift and anomalies, then responds by downscoping, revoking or denying access. Actions are written to a tamperproof record for compliance.
Redaction And Dashboards
PII, PHI and MNPI are caught inline on the response path, either by pattern matching or by a judge model. Dashboards show agent topology, spend attribution and governance status.
Integrations
| Area | Integrations |
|---|---|
| Identity providers | Okta, Ping, Microsoft Entra ID |
| AI agents and tools | Claude, ChatGPT, Gemini, Microsoft Copilot, Cursor, Replit and in-house agents |
| Enterprise apps and data | Salesforce, DocuSign, Slack, Microsoft 365, GitHub, Snowflake |
| SIEM, SOAR and XDR | Splunk, CrowdStrike, Datadog, Microsoft Sentinel |
| Virtual desktops (Arculix) | Citrix ADC, Citrix Virtual Apps & Desktops, Citrix FAS |
Company Background
| Founded | 2005 |
|---|---|
| Headquarters | Irvine, California, United States |
| Leadership | Geoffrey Mattson (CEO) and Mark van Oppen (Chief Revenue Officer) |
Note: This overview is compiled from SecureAuth’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.