Enterprise Identity Services
Phishing-resistant sign-in for every employee, from strategy to rollout.
Rollouts rarely stall on hardware. They stall on identity platforms, legacy apps and shared workstations. Our identity team takes you from strategy to every user enrolled, and ships the keys too.
- Yubico Gold Partner with a Professional Services Certified team
- ISO/IEC 27001 and ISO 9001 certified
- Government, defence and enterprise customers
- Hardware stocked in six regional distribution centres
Who signs in
- Office and remote staff
- Frontline and shared workstations
- Administrators
- Contractors and partners
What they sign in with
- YubiKey
- HID Crescendo card and OMNIKEY reader
- AuthenTrend fingerprint key
- KSI keyboard with built-in reader
What verifies them
- Entra ID, Okta, Ping or Google Workspace
- Cisco Duo
- Palo Alto Networks Idira
- Silverfort
What they reach
- SaaS and cloud apps
- Windows sign-in
- VPN and remote access
- On-premises and legacy apps
One example path: ward staff tap a badge on a shared workstation to sign in to Windows. Every user group gets its own path, designed around how it works.
What we deliver
Take one service or all five. Most engagements start with the strategy and grow from there.
End user authentication strategy
Not every employee should sign in the same way. We assess how each group works today, set a phishing-resistant target state and match the right authenticator to each group, from office staff and administrators to frontline teams on shared workstations.
- Assessment of current sign-in methods, MFA coverage and gaps
- Target state and authenticator mix by user group
- Recovery, replacement and lifecycle policy
- Mapping to NIS2, DORA and your internal security policies
- A costed roadmap ready for board approval
Identity platforms
Design, harden and connect the platform that verifies every sign-in.
- Entra ID, Okta, Ping Identity and Google Workspace design and hardening
- Conditional access, authentication strengths and phishing-resistant policies
- Federation and SSO consolidation across your applications
- Cisco Duo, Silverfort and Palo Alto Networks Idira where they are part of your stack
Passkey rollouts
From a signed-off strategy to every user enrolled, without flooding the help desk.
- Policy for hardware-bound and synced passkeys
- Enrolment model: self-service through SSO, supervised or pre-registered
- A pilot group, then rollout in waves
- Staff guides, help desk runbooks and recovery processes
Legacy application modernisation
Most rollouts stall on the apps that cannot do modern sign-in. We fix them cheapest option first.
- Protect in place with Silverfort, with no code changes
- Retrofit OIDC or SAML, or add an identity-aware proxy
- PIV smart card sign-in for Windows and older systems
- Rebuild by our own engineers where nothing else will do
Project management
One accountable project manager runs the programme from kickoff to handover.
- Plan, waves and milestones agreed up front
- Stakeholder and staff communications
- Risk, issue and status reporting on a fixed cadence
- Hardware delivery and enrolment kept in step
Hardware and platforms we work with
The strategy decides the hardware, not the other way round. These are the authenticators we deploy and where each one fits.
| Authenticator | Best for | What it does |
|---|---|---|
| YubiKeyYubico | Office and remote staff, administrators and high-assurance roles | FIDO2 and passkeys, PIV smart card, OTP on the YubiKey 5 Series. FIPS 140-3 models for government and regulated customers. |
| CrescendoHID | Staff who already carry a badge; shared and clinical workstations | FIDO2 and PIV on a card or key. Can combine staff ID, building access and Windows sign-in in one credential. |
| OMNIKEYHID | Workstations without a built-in reader | Contact and contactless smart card readers, so Crescendo cards and existing badges work for PC sign-in. |
| ATKeyAuthenTrend | Users who would rather not use a PIN | FIDO2 keys and cards with an on-device fingerprint sensor. Fingerprints never leave the key. |
| KeyboardsKSI | Fixed desks, frontline and clinical stations | Keyboards with a built-in fingerprint, smart card or RFID reader, so there is nothing extra to carry or lose. |
Identity platforms
We design, configure and integrate across the platforms your organisation already runs.
Identity providers
Verify every sign-in
- Microsoft Entra ID
- Okta
- Ping Identity
- Google Workspace
MFA
Strengthen existing sign-in
- Cisco Duo
Privileged access
Protect admin accounts
- Palo Alto Networks Idira (formerly CyberArk)
Identity protection
Cover systems with no modern sign-in
- Silverfort
How an engagement runs
Five stages, each with a clear output. You can stop after any stage with something useful in hand.
- 2 to 4 weeks
Assess
Interviews, configuration review and an inventory of how every user group signs in to every app.
- Signed off
Design
Authenticator mix, platform configuration, enrolment model and recovery policy, documented for approval.
- Your hardest cases
Pilot
A representative group that includes legacy apps, shared workstations and remote staff.
- In waves
Rollout
By site, team or region, with hardware shipped to each employee through our procurement and delivery service.
- Yours to run
Handover
Runbooks, admin training and a lifecycle process your team can operate, with optional ongoing advice.
Three ways to work with us
Start small and commit once the plan is clear, or bring us in for the full programme.
Assessment
Best for deciding what to do before committing budget.
- Scope
- Fixed
- Pricing
- Fixed price
- Duration
- 2 to 4 weeks
- You get
- Findings, target state and costed roadmap
Delivery project
Best for taking an agreed plan through to every user enrolled.
- Scope
- From the assessment
- Pricing
- By milestone
- Duration
- Set by your waves
- You get
- Design, pilot, rollout and handover
Advisory
Best for teams running their own programme who want an expert on call.
- Scope
- Agreed hours
- Pricing
- Monthly
- Duration
- Ongoing
- You get
- Design reviews, new apps and policy changes
One team for the plan and the hardware
Most identity consultancies stop at the design document. We also hold the keys in stock and ship them to each employee, so the plan and the parcels run on the same schedule.
We plan the rollout
Waves, enrolment dates and help desk cover are set in the project plan, with your identity platform configured before the first parcel leaves.
We ship the keys
Our procurement and delivery service ships to each employee from stock in our own distribution centres, with local taxes handled. Delivery confirmations tell your team who has a key in hand, so enrolment starts on time.
Common questions
What identity, security and procurement teams usually ask before a scoping call.
Do we have to buy hardware from Trust Panda?
No. We work with authenticators you already own or buy elsewhere. Buying the hardware from us means delivery and enrolment run on one plan, but it is not a condition of any engagement.
Are you tied to Yubico?
No. We are a Yubico Gold Partner and our team holds Yubico Professional Services Certification, but we also deploy HID, AuthenTrend and KSI hardware. Each user group gets the authenticator that fits how it works.
Do you work remotely or on site?
Assessment and design are mostly remote. We come on site for workshops, pilots and enrolment days where it helps the rollout.
Which regions do you cover?
Europe, Australia, New Zealand, North America and India, matching the regions where we hold hardware stock.
Can you work in regulated and government environments?
Yes. We operate an ISO/IEC 27001 certified management system, supply FIPS 140-3 hardware and already work with government and defence customers.
Will you change our application code?
Only if it is the best option. We start with approaches that need no code changes and bring in our engineers for a retrofit or rebuild where nothing else will work.
Plan your rollout with us
Tell us your headcount, identity platform and the apps you are worried about. We will set up a scoping call and outline what an assessment would cover.
Prefer to talk? Call +36 1 955 5888, Monday to Friday, 9am to 5pm CET, or email support@trustpanda.com.