Detect once. Protect everywhere. In milliseconds.
Sovio Sanket exchanges identity threat signals across organisational boundaries in real time. When one entity detects an account takeover, every other entity in the network acts on it automatically — using the OpenID Shared Signals Framework.
SSF defines the framework. CAEP covers access events. RISC covers risk events. SECURE_EVENT_TOKEN secures every signal. No vendor lock-in.
The attacker is shared. The defence is not.
Identity threats cross organisational boundaries. Defences do not.
When an attacker compromises an account at one bank, the same credential is immediately tested across every other bank, fintech and platform the user touches. The attack is cross-organisational by nature — but defences are siloed. Each org detects the same attacker independently, hours or days apart, while the attacker moves freely between targets.
Existing threat intelligence was not designed for identity signals.
Traditional feeds share IPs, domains and file hashes — not identity events. They do not carry subjects, sessions or token references. They are built for SOC analysts, not for IAM systems that must block a login in real time. Identity threat signals need a different architecture: event-driven, subject-centric, machine-actionable.
An organisation detects an identity threat
Bank A's fraud system flags an account takeover — unusual login, new device, hostile IP. The signal is real, the subject is known.
Detection happens inside the publisher; Sanket starts at the next millisecond.
One detection. Six seconds. Whole ecosystem protected.
- 00:00Bank A detects ATOUnusual login from new device and hostile IP. Fraud engine confirms account compromise.
- 00:01SET mintedEvent wrapped as SECURE_EVENT_TOKEN — subject, event type, timestamp, signed by Bank A.
- 00:02Published to streamPOST /rest/events hands the SET to consortium.fraud.v1.
- 00:03Subscribers notifiedBank B, Bank C and Fintech X receive the SET on authenticated webhook endpoints.
- 00:04Signature verifiedEach receiver verifies ECDSA-P256 against Bank A's public key. Freshness and subject confirmed.
- 00:05Automated responseSessions revoked, tokens invalidated, accounts challenged across the ecosystem.
- 00:06Attacker blocked everywhereAudit trail closed. Tamper-evident. Regulator-ready.
Six guarantees. Not policy — properties.
- 01Every signal is a signed SECURE_EVENT_TOKEN — verifiable by any subscriber.
- 02Streams support subject-level filtering and per-subscriber authorisation.
- 03Delivery is sub-second, authenticated and retried on failure.
- 04Response is automated — sessions, tokens and accounts act on signals natively.
- 05Built on open standards: OpenID SSF, CAEP, RISC. No proprietary lock-in.
- 06Issuance, delivery, verification and response are logged to an immutable audit trail.
Built on open identity standards — end to end.
Threat signal exchange engineered for every regulated ecosystem.
For security architects, IAM engineers and integration leads.
{
"iss": "https://bank-a.example",
"jti": "urn:uuid:abc-123-def",
"iat": 1758103800,
"events": {
"https://schemas.openid.net/secevent/risc/event/type/account-takeover": {
"subject": {
"subject_type": "email",
"email": "user@example.com"
},
"reported_timestamp": "2025-09-17T10:30:00Z"
}
}
}stream = "consortium.fraud.v1";
ok = verify_set(token, issuer_pubkey);
if (ok && fresh(token)) → REVOKE sessions · CHALLENGE account
else → DROP (audit logged)
Configure downstream actions — session termination, token revocation, step-up auth, transaction blocking — per signal type, severity and organisational policy.
See Sovio Sanket
in your ecosystem.
Sovio Sanket is launching soon. Join the waitlist to get early access, launch updates and direct line to our team for design-partner conversations.