Why HBX
Identity vendors stop at the cloud. HBX goes the rest of the way, to the systems that run the business.
A named person or agent gets exactly one system for one window, authorized against your own identity provider. That includes the legacy systems that never spoke modern identity.
How HBX compares
How HBX compares with a VPN, a vault, cloud identity and OT vendors.
Four head-to-head comparisons with what you already run or are evaluating, plus the open standards HBX is built on.
vs. a VPN
A VPN puts you on the network, not into a system
It puts you on the whole network and calls it access. No limit, no named owner, no clock, and free movement to everything next door.
See whyvs. a credential vault
A vault stores the standing credential better. It still exists
Rotation shortens the window. It doesn't close it. With HBX there is no permanent password to begin with.
See whyvs. cloud infrastructure identity
Cloud and workload identity vendors built real machine identity
The question isn't whether they work. It's where they stop, and whether the human behind the agent is checked once or every time.
See whyvs. an OT-native vendor
Whose identity provider decides which agent gets in
HBX keeps the decision in your own identity provider, on open standards. Proprietary fabrics keep it inside their product.
See whyThe standards
OpenID Connect, ID-JAG, Cross-App Access, DPoP, CIBA
The open delegation chain HBX is built on, explained in plain language.
See whySide by side
What each kind of vendor covers, and what it doesn't.
Vendors who reach the plant floor without modern agent identity, vendors who built modern agent identity and pointed it at cloud rather than the plant floor, and the one vendor closest to both.
| Capability | OT & legacy remote access | Cloud & machine identity | OT-native + agent identity | HBX |
|---|---|---|---|---|
| An agent acts for a person across companies (ID-JAG, Cross-App Access) | ||||
| A named person's approval, checked every time (CIBA) | partial | partial | unclear | |
| Agent access that can't be copied and reused (DPoP) | partial | unclear | ||
| Reaches older systems that aren't web-based | ||||
| Lets another company's staff in with their own employer's sign-in | unclear |
Why it matters
Your vendors, your contractors and their agents all reach your systems. HBX decides who, and for how long.
HBX lets in someone another company's own sign-in vouches for, keeps every action traceable to a named person, and puts an approval in front of every destructive action. A connector inside your network then creates a temporary login on a system that was never built for modern sign-in, and removes it when the window ends.
If your agents, or your contractors, have to reach a system that isn't yours, talk to us before you shortlist anyone else.