Ashur Kanoon

Director of Technical Product Marketing

About Author

Ashur Kanoon is the technical product marketing guy at Aembit. He started his career as a software engineer at Cisco working on Y2K. Yes, that Y2K. Today, he takes what excited and highly caffeinated engineers build and makes sure business and technical buyers understand why it matters. He has done this at a spinout that was lateracquired and at two other startups, both of which were also acquired.Outside of work, Ashur enjoys mechanical things, mostly cars and watches, and spending time with his wife and two teenagers.

Expertise

  • Cybersecurity
  • Identity and access management
  • Non-human identity
  • Workload identity and access management
  • AI agent security
  • Enterprise security
  • Cloud and infrastructure security
  • Enterprise networking
  • Authentication and authorization
  • Software engineering
  • Product management
  • Technical product marketing

Education

  • Center for Executive Education, University of California, Berkeley
  • Master of Business Administration, San José State University
  • Bachelor’s degree in computer information systems, DeVry Institute of Technology

Certifications

  • AWS Certified Cloud Practitioner
  • CCNA, Cisco
  • JNCIS-AC, Juniper Networks

Articles by Ashur Kanoon

OAuth is an authorization framework that defines how to grant access. JWT is a token format that defines how to package and transmit claims. They solve different problems, and most production systems use both.
SPIFFE focuses on who a workload is. It issues cryptographic identities to services and workloads so they can prove their authenticity to each other without relying on stored secrets. OAuth focuses on what a workload is allowed to do. It defines how access is delegated and controlled when one service needs to interact with another or call an external API.
SPIFFE focuses on who a workload is. It issues cryptographic identities to services and workloads so they can prove their authenticity to each other without relying on stored secrets. OAuth focuses on what a workload is allowed to do. It defines how access is delegated and controlled when one service needs to interact with another or call an external API.
In MCP, every request comes from a nonhuman identity: an agent, server or tool. These identities don’t act under direct human oversight. They generate requests dynamically, chain operations and carry data across trust boundaries.
Service accounts are indispensable, but their security weaknesses make them the most attractive target in enterprise environments.
This update gives every Jenkins job a real identity and automated short-lived access so teams can retire static secrets without changing how their pipelines run.
OAuth 2.1 eliminates implicit flow, mandates PKCE, and requires exact redirect matching.
Securing MCP servers requires rethinking the entire communication stack, not just adding TLS and calling it done.
Choosing the right flow is only the beginning. The real challenge is implementing either flow without creating persistent credential vulnerabilities that undermine your security.
Aembit’s AWS Secrets Manager integration makes it easier to protect AI and workload access today – and evolve toward short-lived, policy-driven authentication.
IAM migrations stall in hybrid enterprises due to massive on-prem Active Directory (AD) deployments, budget and regional constraints, and a lack of alignment among development, DevOps, and security teams.