--- title: Security Incident Containment with Teleport | daily.dev description: Teleport 7.1 introduces Session and Identity Locking, a feature that lets security teams instantly suspend active and future SSH, database, and Kubernetes... canonical: https://daily.dev/posts/security-incident-containment-with-teleport-toqegmtfq twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Security Incident Containment with Teleport | daily.dev og:description: Teleport 7.1 introduces Session and Identity Locking, a feature that lets security teams instantly suspend active and future SSH, database, and Kubernetes... og:url: https://daily.dev/posts/security-incident-containment-with-teleport-toqegmtfq og:image: https://api.daily.dev/og/posts/toQEGMtfQ.png og:image:alt: Security Incident Containment with Teleport og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Security Incident Containment with Teleport **[Teleport](https://daily.dev/sources/teleport)** · 7 min read · 0 upvotes · 0 comments ## Summary Teleport 7.1 introduces Session and Identity Locking, a feature that lets security teams instantly suspend active and future SSH, database, and Kubernetes connections tied to a compromised user, role, MFA device, OS login, or node, without downtime. The post explains how this supports NIST-style incident containment phases, enables live patching and certificate revocation, allows time-bound locks, preserves session evidence, and integrates with SOAR platforms via the tctl CLI (e.g., tctl lock). ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I lock a compromised user's access in Teleport without restarting services? Teleport 7.1 introduced a Session and Identity Locking feature that suspends active and future SSH, database, and Kubernetes connections and certificate requests at runtime, with no service restart required. Locks can target a user by name, an RBAC role, an MFA device UUID, an OS/UNIX login, or a node UUID. Example command: tctl lock --use=alice@example.com --message="Suspicious activity" --ttl=10h. _daily.dev surfaces access-control releases like this for teams building incident response playbooks._ ### Can Teleport revoke a certificate after it has already been issued? Yes, Teleport's Session Locking feature (added in version 7.1) can invalidate signed and trusted certificates even though certificate-based auth like JWT normally makes revocation hard, because locking is enforced at the session level rather than at issuance. This is useful for containing insider threats where a valid certificate has already been distributed. _Teams evaluating certificate revocation strategies can track access-control changes like this on daily.dev._ ### Why does locking a specific user's access matter more than shutting down a server during a security incident? Shutting down production servers to contain an incident causes service downtime, which can cost a business as much as $9,000 per minute, often more than the security incident itself. Identity-based locking lets responders block only the malicious user's access while keeping other sessions and services running, avoiding that downtime cost entirely. _daily.dev helps engineers weighing containment tradeoffs like this stay current on access platform updates._ --- Tags: [#authentication](https://daily.dev/tags/authentication) [View this post on daily.dev](https://daily.dev/posts/security-incident-containment-with-teleport-toqegmtfq) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Security Incident Containment with Teleport","url":"https://daily.dev/posts/security-incident-containment-with-teleport-toqegmtfq","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/security-incident-containment-with-teleport-toqegmtfq"},"datePublished":"2026-08-23T12:21:43.099Z","dateModified":"2026-08-23T12:39:57.296Z","description":"Teleport 7.1 introduces Session and Identity Locking, a feature that lets security teams instantly suspend active and future SSH, database, and Kubernetes...","image":"https://media.daily.dev/image/upload/s--0_ODbtD2--/f_auto/v1722860399/public/Placeholder%2008","thumbnailUrl":"https://media.daily.dev/image/upload/s--0_ODbtD2--/f_auto/v1722860399/public/Placeholder%2008","isAccessibleForFree":true,"articleSection":"Teleport","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Teleport","logo":"https://media.daily.dev/image/upload/s--Dw-Bbw6O--/c_limit,w_256/f_auto,q_auto/v1787487494/logos/teleport?_a=BAMAMicg0","url":"https://daily.dev/sources/teleport"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/security-incident-containment-with-teleport-toqegmtfq","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"authentication","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Teleport","item":"https://daily.dev/sources/teleport"},{"@type":"ListItem","position":3,"name":"Security Incident Containment with Teleport"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/security-incident-containment-with-teleport-toqegmtfq#faq","mainEntity":[{"@type":"Question","name":"How do I lock a compromised user's access in Teleport without restarting services?","acceptedAnswer":{"@type":"Answer","text":"Teleport 7.1 introduced a Session and Identity Locking feature that suspends active and future SSH, database, and Kubernetes connections and certificate requests at runtime, with no service restart required. Locks can target a user by name, an RBAC role, an MFA device UUID, an OS/UNIX login, or a node UUID. Example command: tctl lock --use=alice@example.com --message=\"Suspicious activity\" --ttl=10h. daily.dev surfaces access-control releases like this for teams building incident response playbooks."}},{"@type":"Question","name":"Can Teleport revoke a certificate after it has already been issued?","acceptedAnswer":{"@type":"Answer","text":"Yes, Teleport's Session Locking feature (added in version 7.1) can invalidate signed and trusted certificates even though certificate-based auth like JWT normally makes revocation hard, because locking is enforced at the session level rather than at issuance. This is useful for containing insider threats where a valid certificate has already been distributed. Teams evaluating certificate revocation strategies can track access-control changes like this on daily.dev."}},{"@type":"Question","name":"Why does locking a specific user's access matter more than shutting down a server during a security incident?","acceptedAnswer":{"@type":"Answer","text":"Shutting down production servers to contain an incident causes service downtime, which can cost a business as much as $9,000 per minute, often more than the security incident itself. Identity-based locking lets responders block only the malicious user's access while keeping other sessions and services running, avoiding that downtime cost entirely. daily.dev helps engineers weighing containment tradeoffs like this stay current on access platform updates."}}]} ```