Register for part 2 of our Device Identity Webinar Series!

The other half of Zero Trust

Most organizations start their Zero Trust journey with Single Sign-On (SSO), Multi-Factor Authentication (MFA), and user access policies. Yet every endpoint—laptops, servers, containers, and IoT devices—represents another identity that can be compromised. True Zero Trust requires securing both user and device identities.

Contact us
background gradientbackground texture
Device Inventory list UI

High assurance device identity for Enterprise IT

Device identity ensures only trusted, company-owned devices can access your most sensitive resources, including Wi-Fi networks, VPNs, financial dashboards, intellectual property, and GDPR-sensitive databases. Smallstep delivers hardware-backed device identity, providing the strongest protection against credential theft, phishing, and impersonation attacks.

Learn more
ACME device attestation diagram showing Apple Attestation Server, ACME Server, and Organization Servers verifying device identity through attestation flow

ACME Device Attestation is here to replace SCEP

Smallstep worked with Google at the IETF to develop the new standard for high-assurance device identity, ACME Device Attestation (ACME DA). ACME DA provides the strongest possible guarantee of authentic device identity, preventing credential exfiltration, phishing, and impersonation attacks.

Learn more

Built on trusted open source foundations

Smallstep’s platform is built upon proven, open-source software trusted by 78 of the Fortune 100 companies to secure critical DevOps workloads. Our cryptographic code benefits from transparency and rigorous community scrutiny—delivering security you can rely on.

Learn more
Step CA Pro + Smallstep

Unlock the missing half of Zero Trust

You've secured user identities—but what about device identities? Discover how closing this critical gap can strengthen your entire security posture. Download our white paper to learn more.

Download
background gradient
Device Identity Platform

Critical components of device identity

By bridging the gap between security standards and operational reality, Smallstep simplifies the implementation of high assurance device access, providing businesses with a modern and secure ecosystem. To achieve high assurance device identity you’ll need four foundational components in place.

Learn more

Never miss new content

Logos of common integrations

Integrates with your existing security stack

The Device Identity Platform™ extends your existing enterprise ecosystem. We integrate with all major mobile device management (MDM), identity provider (IdP), and device posture platforms to provide a seamless and secure user experience. These integrations augment and harden user identity and extend the reach of device posture systems by automatically revoking device credentials when a device is removed from inventory or if posture checks fail.

See all integrations

Leading the industry in Zero Trust for devices

Empower your teams to work at the pace and scale of modern engineering.

Book a demo

FAQs About Device Identity and Zero Trust

Device identity is a cryptographic, hardware-bound credential that proves a specific device is trusted before it connects to enterprise systems. In a Zero Trust model, verifying the user is not enough. Each laptop, server, container, or workload must also present a strong device identity so access decisions can be based on both who and what is requesting access.

User authentication proves who someone is, but it does not verify the security posture or integrity of the device they are using. Compromised, unmanaged, or spoofed devices can still pass user authentication. True Zero Trust requires validating both user identity and device identity to reduce credential theft, phishing, and session hijacking risks.

SCEP was designed for simpler environments and lacks strong device attestation capabilities. Modern environments are moving toward ACME-based device attestation standards developed within the IETF. ACME Device Attestation enables automated, high-assurance certificate issuance tied to hardware-backed proof, reducing impersonation and credential abuse.

ACME Device Attestation extends the ACME protocol to allow devices to prove their authenticity using hardware-backed evidence before receiving a certificate. This creates a verifiable chain of trust from device hardware to enterprise services and helps prevent certificate issuance to unauthorized or cloned devices.

Even if an attacker steals user credentials, they cannot access protected systems without a valid device certificate issued to a trusted device. Device identity adds a second cryptographic boundary that cannot be bypassed with passwords, tokens, or session cookies alone.

Device identity complements existing identity and access management systems. It integrates with MDM platforms for device enrollment, works alongside OIDC and SSO providers for user authentication, and can enforce certificate-based authentication for VPNs, SSH, Wi-Fi, and internal applications.

No. Device identity applies to servers, Kubernetes workloads, containers, IoT devices, and production infrastructure. Any endpoint that connects to enterprise systems represents a potential trust boundary and benefits from cryptographic device authentication.

Posture checks evaluate device configuration or compliance at a point in time. Device identity establishes cryptographic proof that the device itself is authentic and trusted. Posture can change and be spoofed. Strong device identity creates a persistent trust anchor for access control decisions.

Certificate-based authentication ensures that only devices with valid, short-lived credentials can establish network sessions. This strengthens Zero Trust Network Access by eliminating shared secrets and reducing reliance on IP-based or network perimeter assumptions.

Without strong device identity, enterprises face increased risk of lateral movement, credential replay, impersonation attacks, and unauthorized access to sensitive systems. As organizations adopt cloud, remote work, and AI-driven automation, unmanaged or spoofed devices become a primary attack vector if not cryptographically verified.