Programme

Chair of the Conference Martin Braun warmly welcomes you to the plenary hall during the first edition of Identity & Access Management Denmark  and will walk you through today’s agenda.

In this session, we will explore the critical intersection of Artificial Intelligence (AI) and impact on cybersecurity. You’ll gain insights into what AI Security entails, the Security AI Framework, and the various AI Security models shaping today’s landscape. We will examine the key threats and risks associated with AI, and discuss practical strategies to mitigate these challenges through robust security capabilities. We’ll also examine how AI Security reshapes Identity and Access Management (IAM), and what steps organizations can take to stay resilient in this rapidly changing security landscape.

IGA modernization can be approached as an integration- and data-driven evolution of existing capabilities. IGA can be modernized through modular integration, where ITSM tools act as the user-facing front end and connect with CMDB data to provide application and service context. Through APIs, IGA can support access requests and fulfilment flows, while data is also extracted into enterprise data platforms such as Databricks for role mining, access risk insights, audit evidence, and reporting. This API enablement and data foundation can then support MCP and agent-based integrations, enabling intelligent assistants to retrieve context, trigger workflows, and guide users through policy-compliant access processes. These capabilities can be delivered with on-premise IGA solutions, while assessing whether to build custom AI capabilities on extracted data or use the IGA platform’s built-in AI tools.

In the modern AI enterprise, elevated privileges are no longer restricted to a small group of system administrators; every identity now operates with broad access to critical systems. Based on the Idira platform approach, David Higgins explores how traditional Privileged Access Management (PAM) must evolve into a unified identity security control plane. The session will examine how organizations can extend dynamic privilege controls, zero standing privileges, and governance across all three core identity tiers: human users, automated machine workloads, and emerging autonomous AI/agentic identities. Delegates will gain insights into discovering hidden identity risks, applying just-in-time access, and securing the entire identity lifecycle to minimize attack surface without slowing business innovation.

Identity has become a critical control point for organisational resilience. In this session, we look at how organisations can strengthen cyber-recovery and threat containment across both their data and identity estate. The focus goes beyond prevention alone. You will learn how to build for rapid response and recovery, minimise downtime and business disruption, and maintain control during an attack. The session also explores how a zero-trust architecture can help organisations stay operational and protect critical data, even during ransomware or other major cyber incidents.

As organizations transition from simple chatbots to autonomous AI agents, the traditional security perimeter shifts. These agentic systems often operate with extensive access rights and minimal oversight, creating a new risk area: Shadow AI.   In this session, we explore how organizations can bring these autonomous actors together under a single, integrated identity control plane. We will discuss practical strategies for discovering unmanaged agents, assigning human ownership, enforcing least-privilege access, and ensuring full auditability and human oversight, allowing organizations to embrace AI innovation without losing control.   Participants will learn how to effectively manage and secure their agentic workforce by identifying and controlling Shadow AI risks, establishing unified identity governance, and balancing AI innovation with security and accountability, while creating the foundation for the next generation of AI-driven innovation.   Key takeaways: Shadow AI Risk Management: Identify and control unmanaged autonomous AI agents. Identity Control for AI Agents: Implement unified governance with least-privilege access. Secure AI Innovation: Balance AI transformation with auditability and human oversight.

Identity is the new battleground, and organizations have made real progress securing human identities. Yet a critical blind spot remains: machine identities and AI agents. Machine identities now outnumber humans by orders of magnitude. They're always on, rarely reviewed, and accumulate privilege silently. AI agents are accelerating the problem. Autonomous and often over-permissioned, they operate undetected across environment boundaries, mainly because organizations operate in silos and stack point solutions instead of building a coherent model. This session cuts through the AI hype and makes the case for a holistic privilege-centric identity security approach applied consistently across human, machine, and agentic AI identities. You'll come away with practical ways to break down identity silos, get rid of blind spots, and give your security team the visibility and control they need to protect every identity and every privilege, wherever it lives.

AI agents are rapidly becoming part of the enterprise identity landscape—but traditional identity security tools were not designed to govern them.   In this session, you’ll learn how to approach AI agent identity security, from discovery and ownership to access governance and ongoing risk management. We’ll explore how to discover and correlate agents across platforms, establish clear accountability, understand what agents can access, and identify changes that introduce risk. The session will also cover how drift detection and credential lifecycle management can support continuous governance as agent environments evolve.

As AI reshapes the digital landscape, how do we protect trust, privacy and compliance without slowing innovation? In this engaging presentation, we’ll explore real-world scenarios and invite the audience to share perspectives, test assumptions and consider the trade-offs involved. Together, we’ll examine what it takes to build AI-powered digital experiences that are secure, seamless and worthy of trust.

AI agents are becoming users within your organisation. They authenticate, receive permissions and act with delegated authority, faster and at a scale no human user ever could. How we govern these agents is rightly getting a lot of attention. But there is another question that is often overlooked: where does the identity layer controlling them run, who operates it and which laws apply? If AI agents can act on everything your IAM environment allows, control over that identity layer is no longer just a compliance issue. It becomes a matter of operational security. Drawing on more than two decades of experience building identity infrastructure in the Nordics, Trivore explores what practical digital sovereignty actually looks like and how European organisations can benefit from AI without giving up control of their most critical identity infrastructure. You’ll leave with practical criteria to assess the jurisdictional risks within your own identity stack.

PAM protects privileged accounts and sessions. But who controls changes inside the directory itself? This session explores why Active Directory and Entra ID are attractive targets for attackers, and how changes to groups and permissions can create risks that persist after a session ends. We introduce a complementary approach to PAM: controlling directory changes before they happen, with clear rules governing who can change what.

IAM programs are embracing passkeys, phishing-resistant MFA, and Zero Trust architectures. Yet many organizations continue to face the same challenge:   How do you securely establish trust for someone who has no trusted credential yet?   Despite significant advances in authentication, we still rely on temporary passwords, email distribution, Service Desk verification, manager handoffs, or other manual processes to get new employees online.   This roundtable explores the gap between the passwordless vision and onboarding reality. There is no right answer. The objective is to exchange experiences, lessons learned, and common pitfalls . Participants are invited to share how their organizations approach first-day access, identity verification, remote onboarding, credential delivery, and account recovery.

How do you build a future-proof CIAM strategy that actually drives business value? In this session, learn from a real-world transformation where B2B and B2C identity were rebuilt from scratch under high pressure. Discover how to balance security and customer experience, deliver quick wins with measurable ROI, and create an IAM operating model that the business actually adopts. Walk away with practical insights on turning CIAM into a growth enabler rather than a bottleneck.

Attackers no longer target just privileged passwords; they target identities. Discover why modern organizations are expanding beyond traditional PAM and adopting a broader identity-centric security strategy. Through real-world experiences and lessons learned, this session explores how to better protect privileged access in today's hybrid and cloud-first environments.

Three questions decide whether an agent's action is safe: On whose authority, for which task, and until when. And most systems cannot answer any of them. That is not because agents are new, but because the authorization underneath them was decided in advance, buried inside each application, and unable to explain itself. That held up only while access was limited by skill and everything ran at human speed. And agents removed both those limits. At Gartner in 2024 I wrote that AuthZEN was the standard to watch. It became final in January. This session covers what that makes possible, what it still does not, and five things worth doing before you buy anything.

IAMUNI is a new framework for IAM Threat Modeling, designed to bring more structure, consistency and IAM-specific context to the way identity threats are identified and assessed. But how can management and compliance risks travel from the cloud, through Digital Risk Management on the shore, into IAM Threat Modeling in the water, and then return as understandable information for management decisions? IAMUNI extends STRIDE with paired Anti-Patterns and Protection Objectives, standardised Threat Actors, reusable IAM threats, and recognised sources such as CAPEC and CWE. By connecting IAM Threat Modeling with business-level Risk Scenarios, Digital Risk Management and Enterprise Risk Management, the framework aims to bridge the gap between technical identity threats and management-level risk. And because IAMUNI is still evolving, IAM professionals are invited to challenge it: question the model, identify gaps, test its assumptions and bring in real-world IAM experience. The goal is not only to introduce IAMUNI, but to put it to the test.