For decades, identity security has been built around people. That assumption is breaking down. Machines, APIs, workloads, applications and AI agents now require access to critical systems and data.

This keynote explores what identity means when digital interactions increasingly occur without a human directly involved.

• Non-human identity explosion
• Machine and workload identities
• AI agent identity
• Privileged access for autonomous systems
• Continuous authentication and authorization
• Identity as the foundation of AI security

The identity perimeter is expanding rapidly. Every new workload, API, machine and AI agent introduces another relationship that must be trusted, monitored and governed.

• Who gives an AI agent its identity?
• Should machines receive the same privileges as employees?
• How do we prevent identity sprawl?
• Can zero trust work in an autonomous environment?
• How do we revoke access from systems operating continuously?
• What happens when one compromised identity can control thousands of machines?

Traditional identity security was designed around humans logging into applications. The autonomous enterprise requires identity decisions to happen continuously and programmatically.

This session explores the architecture required to secure machine-to-machine and agent-to-system interactions.

• Machine identity
• Secrets and credentials
• Privileged access
• Policy-based authorization
• Identity governance
• Continuous verification

The Cyber Resilience Act changes the way organizations must think about product security, software vulnerabilities and digital supply chains. With the December 2027 deadline approaching, security leaders need to understand what the regulation means beyond legal interpretation.

• Secure-by-design
• Vulnerability management
• Software supply chains
• SBOMs
• Product security
• Supplier accountability
• Incident reporting
• Security throughout the product lifecycle

The CRA has the potential to fundamentally change how European organizations develop, procure and manage digital products. But will organizations treat it as another compliance obligation — or use it to fundamentally improve security?

• Who owns CRA responsibility inside the enterprise?
• How should CISOs work with product and engineering teams?
• What happens to legacy products?
• How should organizations assess suppliers?
• Can procurement become a security control?
• What will enforcement change?

Security cannot be added at the end of the product lifecycle. This session explores how organizations can translate regulatory expectations into practical security engineering and product development.

• Security architecture
• Vulnerability disclosure
• Product lifecycle security
• Software supply-chain visibility
• Security testing and assurance

Organizations spend enormous resources protecting their own infrastructure. But some of the most consequential failures originate somewhere else — a cloud provider goes down, a critical supplier is compromised, an identity platform becomes unavailable, a software dependency fails, a telecommunications network is disrupted.

This keynote asks a different question: what happens when the thing we depend on fails — not by accident, but by geopolitical design?

• Concentration risk
• Cloud dependency
• Critical third-party providers
• Digital supply-chain disruption
• Identity and SaaS dependency
• Weaponized interdependence
• Subsea cable and infrastructure sabotage
• Sanctions impacting SaaS availability
• Business continuity beyond the enterprise perimeter

Modern organizations are ecosystems rather than isolated entities. The resilience of the enterprise increasingly depends on the resilience of its suppliers, technology platforms and infrastructure providers.

• How much dependency is too much dependency?
• Should organizations diversify critical technology providers?
• How do you identify systemic concentration risk?
• Can you build resilience without owning the infrastructure?
• What should the board understand about ecosystem risk?
• Where does third-party risk management end and systemic resilience begin?

The objective of resilience is not to prevent every failure. It is to ensure that critical business functions can continue when failure occurs.

This session explores practical approaches to designing organizations that can absorb disruption.

• Dependency mapping
• Digital continuity
• Recovery architecture
• Multi-provider strategies
• Resilience testing
• Preparing for cascading failures

When AI Becomes Autonomous, Who Do We Trust?

• How much autonomy should organizations give AI agents?
• Who is accountable for an autonomous decision?
• Should AI agents have their own identities?
• Where should human oversight remain mandatory?
• How do we secure agent-to-agent interactions?
• How do we secure non-human identities?
• How do we control machine and AI access?
• Is zero trust still designed for the world we are entering?
• How do we prevent identity and privilege sprawl?
• Can we establish trust without human intervention?

The CRA Reality Check: Can We Survive What We Don’t Control?

• Are organizations actually ready for December 2027?
• Who owns CRA responsibility?
• How will product security change?
• Can procurement become a security control?
• How should organizations manage suppliers that cannot meet new expectations?
• What happens when a critical cloud provider fails?
• How much technology concentration is acceptable?
• Can third-party risk ever be fully understood?
• How do we prepare for cascading digital failures?
• What does systemic resilience look like at enterprise level?