Thales SafeNet Trusted Access Platform

Organizations are modernizing Identity and Access Management (IAM) to respond to rising cyberattacks, expanding privacy/security regulations, and remote work. Because IAM stacks are often hard to upgrade, many buyers prefer modular authentication that can introduce stronger, contemporary login methods and risk engines using Machine Learning to detect anomalous behavior. Authentication has advanced beyond passwords through mobile biometrics, out-of-band apps, push notifications, and hardware tokens, complemented by “behind-the-scenes” evaluation of attributes, behavior, device identity/health, and environmental context. This enables continuous, risk-adaptive authentication that stays unobtrusive until deviations from baselines require step-up verification. Regulations heighten urgency; for instance, the New York SHIELD Act can penalize organizations for unauthorized access to personal information, while PSD2 mandates Strong Customer Authentication in EU financial services. Consequently, strong workforce authentication (including HR data protection) is increasingly prioritized. Selecting access management should emphasize integration with existing IAM, policy-based access control, runtime risk analysis, multiple authenticators, federation standards, and security-system integrations.

Thales SafeNet Trusted Access (STA) is a fully integrated access management suite available as SaaS (hosted in Thales and public data centers in the EU and North America), as VMs in IaaS, or on-premises (Ubuntu/Windows), licensed per user with all features included. It supports bulk provisioning (CSV/LDAP), configurable self-enrollment and recovery workflows, and integrates with major directories and IAM vendors via synchronization kits. STA supports a wide authenticator set (including FIDO2-certified tokens, smart cards, OTP, mobile push, and mobile biometrics), major federation/SSO protocols, and virtual smart cards that use phones for key/certificate storage. Its hierarchical policy authoring enables deep, prioritized rules and step-up flows, while its risk engine evaluates factors like IP, geolocation, impossible travel, device intelligence, and external user behavior analysis inputs. Key challenges include no behavioral biometrics and limited risk-engine interoperability because scores and risk functions are not exposed via API.

• The New York SHIELD Act imposes penalties of up to $250,000 per incident for organizations that allow unauthorized access to personal information.
• PSD2 requires Strong Customer Authentication for finance customers in the EU.
• SafeNet Trusted Access can be deployed on-premises on Ubuntu and Windows.
• SafeNet Trusted Access is offered as SaaS hosted in Thales data centers and in public data centers located in the EU and North America.
• Licensing for SafeNet Trusted Access is per-user and includes all features without additional fees for advanced functions.
• CSV and LDAP can be used for bulk provisioning of users in SafeNet Trusted Access.
• SafeNet Trusted Access supports federation/SSO-related protocols including Kerberos, OAuth, OIDC, RADIUS, and SAML.
• WS-* federation protocols are planned for future support.
• Both cloud-hosted and on-premises versions can scale to process millions of login events per day by linearly adding instances.
• Thales was the first company to certify their HSM as US FIPS 140-3 and is FIPS 140-2/CMVP compliant.

• “IAM technologies are widely deployed, but can be notoriously difficult to upgrade”
• “customers are turning to modular authentication solutions”
• “powered by risk engines utilizing Machine Learning (ML) algorithms to detect anomalous behavior”
• “only interrupting users with explicit need for input when deviations from their established baselines occur”
• “Access control solutions must balance security and usability.”
• “An Identity Fabric is an architecture that can be composed of disparate data sources and capabilities delivered as discrete services.”
• “Licenses include all features of SafeNet Trusted Access”
• “The virtual smart card mechanism allows customers to gain the benefits of strong identity assurance and authentication without the need for obtaining hardware tokens”
• “Policies cannot be imported as JSON or XACML from other access control systems.”
• “Allowing customer applications… access to the risk engine via APIs or to the output of the risk engine would open SafeNet Trusted Access to opportunities that have such requirements.”