For decades, the IBM i operating system has served as the silent, dependable engine room for mission-critical operations across global banking, healthcare, manufacturing, and retail sectors. For just as long, a comfortable and pervasive assumption followed the platform wherever it was deployed: that its inherent architectural security by design and obscurity was enough to ward off malicious actors. Today, that foundational assumption is becoming increasingly difficult to maintain in the face of rapidly escalating cyber threats.

According to recent industry sentiment among IBM i professionals, cybersecurity has officially climbed to the very top of the priority list. This shifting mindset is strongly validated by macro-level threat data. Findings from the IBM X-Force Threat Intelligence Index highlight that identity-based attacks surged by 32 percent during the first half of a recent reporting cycle alone, while vulnerability exploitation firmly established itself as the leading catalyst for corporate security incidents.

The financial and operational stakes attached to these developments have never been higher. The global average cost of a data breach reached a staggering record of $4.99 million—marking a 12 percent increase over the previous year. For organizations relying on the IBM i architecture, past investments in basic platform security tools are no longer sufficient on their own. The modern imperative centers on ensuring that these defensive mechanisms are actively keeping pace with a threat landscape that is growing more sophisticated by the day.

At Precisely, aligning software capabilities with modern threat realities remains a guiding principle for products like Assure Security. Over the past year, the development team has rolled out meaningful, user-driven improvements spanning multi-factor authentication, enterprise-wide security tool integration, and overall platform resilience. These updates are explicitly designed to make comprehensive IBM i security far easier to enforce and trust in complex IT ecosystems.

A Year of Customer-Driven Innovation in Assure Security

Expanding Multi-Factor Authentication Across the Entire IBM i Environment

The implementation of multi-factor authentication has transitioned rapidly from a recommended best practice to a mandatory operational baseline. Regulatory frameworks such as Payment Card Industry Data Security Standard (PCI DSS) version 4.0 made time-based one-time password (TOTP) MFA a mandatory requirement, while independent data from technology leaders like Microsoft consistently demonstrates that MFA successfully blocks more than 99 percent of account compromise attacks, even when malicious actors have already managed to acquire valid credentials. Despite these clear incentives, applying MFA consistently across a traditional IBM i environment has historically presented significant technical hurdles, particularly when dealing with diverse and non-standard access types.

Development efforts have focused heavily on closing those lingering security gaps. Assure MFA has been systematically extended to cover secure shell (SSH) and secure file transfer protocol (SFTP) access channels. Previously, these two critical connection types operated largely outside the reach of conventional MFA enforcement on the platform, leaving file transfer sessions and command-line administrative access exposed to potential compromise.

To streamline daily administration, a dedicated MFA Users page was introduced directly into the platform’s modern web user interface. This enhancement allows system administrators to seamlessly create, update, and delete MFA-registered users entirely within a contemporary management console, eliminating the need to drop back to legacy 5250 green screens. Crucially, these improvements were built directly from customer feedback gathered through early access programs.

Furthermore, platform updates added native support for widely recognized TOTP authenticator applications, including Google Authenticator, Okta Verify, and Microsoft Authenticator. By allowing IBM i login challenges to be handled by the exact same authenticator apps security teams already deploy across the rest of their corporate infrastructure, organizations can finally extend enterprise-standard authentication practices to a platform that has historically been siloed from standard enterprise identity workflows.

Deeper Integration with Enterprise Security Tools

Because enterprise IBM i environments do not operate in a vacuum, modern security tooling cannot afford to remain isolated either. Addressing this operational reality requires tight interoperability with the broader security stacks that organizations rely on for centralized monitoring and incident response. System Access Manager and other core components have been enhanced to work more fluidly with modern enterprise frameworks, reducing administrative overhead and ensuring that security events captured on the IBM i platform are visible to central security operations centers.

Stronger Foundations: Encryption, Compliance, and OS Readiness

Robust cybersecurity posture inherently requires keeping underlying infrastructure current and resilient against known software vulnerabilities. To that end, complete and rigorous certifications for Assure Security and the Enforcive enterprise security suite were successfully finalized for IBM i Operating System version 7.6. This gives enterprise customers the vital confidence that their specialized security tooling functions exactly as intended on the most current platform releases, effectively protecting against the operational vulnerabilities that typically arise when third-party security software lags behind core operating system upgrades.

Attention was also directed toward neutralizing specific network-level threats, such as the CVE-2024-3596 RADIUS Protocol Spoofing Vulnerability. Assure MFA implementations utilizing RADIUS servers were systematically hardened through the incorporation of the mandatory Message-Authenticator attribute required by the associated security patch. For organizations relying heavily on RADIUS infrastructure for authentication workflows, this update closes a genuine exposure vector without forcing administrators to fundamentally re-architect their established network setups.

On the data encryption front, older cipher block chaining modes were systematically retired and consolidated in favor of stronger, more modern encryption standards introduced in recent service packs. This transition ensures that organizations maintain absolute clarity and confidence regarding their active cryptographic posture, removing any operational ambiguity about which encryption protocols are actively protecting sensitive data assets at rest.

Real-Time Audit Visibility Across IBM i LPARs

Compliance officers and internal auditors require near-real-time visibility into system activities across complex, multi-partition environments. To meet this demand, advanced audit reporting capabilities were introduced—including sophisticated tracking designed to identify programs adopting elevated special authorities dynamically across all system partitions. This gives security teams automated, enterprise-wide visibility that traditional manual auditing processes simply cannot replicate. Where administrators previously lacked built-in alerting mechanisms for unauthorized privilege adoption or sudden modifications to approved program execution lists, they now possess a clear, fully auditable picture spanning all logical partitions.

Service Pack Spotlight: OIDC Device Flow Authentication

The release of service pack upgrades, such as Assure Security 7.0.29.00, introduced capabilities specifically engineered to tackle one of the most stubborn authentication challenges inherent to legacy-compatible enterprise architectures: applying modern multi-factor authentication to devices, applications, and connection types that were never originally designed to support interactive user prompts.

The answer to this architectural puzzle lies in OpenID Connect (OIDC) Device Flow authentication. This protocol enables strong, modern authentication for 5250 terminal sessions, ODBC and JDBC database connections, and automated batch jobs—access vectors that traditionally lack browser interfaces or direct keyboard input capabilities.

Under this model, the user’s original connection session pauses while the authentication challenge is dynamically routed to a secondary trusted device, such as a mobile phone or workstation. Once the user successfully completes the verification step on their secondary device, access is immediately granted back to the originating terminal or application workflow.

This technical advancement addresses a critical compliance and security gap, as headless and limited-input connections have long represented some of the final frontiers where modern multi-factor authentication struggled to reach. By implementing the established OAuth 2.0 Device Authorization Grant standard, organizations can finally enforce enterprise-grade MFA across these specialized access types without requiring costly or disruptive modifications to existing device configurations or application codebases.

What Lies Ahead: Deeper Integration with the Security Ecosystem

As IBM i environments become increasingly intertwined with broader enterprise IT infrastructures, security leaders frequently return to a central architectural question: how can specialized platforms like Assure Security fit seamlessly into the existing corporate security stack rather than operating alongside it as a separate silo?

Answering this question forms the core roadmap for upcoming product development. Ongoing engineering efforts are focused on delivering even deeper integrations with enterprise security platforms, including specialized support for LEEF2 formatting within IBM QRadar. This upcoming capability will enable vastly superior event classification, parsing, and correlation of IBM i security logs directly within centralized Security Information and Event Management environments. Furthermore, product teams are actively collaborating with design partners on advanced identity provider integrations to help shape how native IBM i MFA aligns more closely with overarching corporate identity and access management standards.

IBM i Security Has Changed and Tooling Must Keep Pace

The overarching security landscape surrounding the IBM i platform has shifted dramatically. Regulatory bodies continue to raise compliance thresholds on already rigorous standards, malicious actors are executing attacks with increasing velocity, and the long-held institutional assumption that the platform is somehow immune to compromise due to obscurity or design is no longer viable.

The continuous cycle of feature development and hardening delivered over recent years reflects a straightforward commitment: security software must evolve alongside the actual threats facing enterprise organizations rather than lagging behind them. From strict regulatory compliance and innovative device flow authentication to robust enterprise SIEM integrations, these technical advancements are grounded directly in what organizations need to safeguard their most vital digital assets.

Ultimately, customer priorities continue to shape the ongoing development roadmap as organizations navigate the complex realities of modern enterprise cybersecurity on the IBM i platform.