Programme

In this session, we will explore the critical intersection of Artificial Intelligence (AI) and impact on cybersecurity. You’ll gain insights into what AI Security entails, the Security AI Framework, and the various AI Security models shaping today’s landscape. We will examine the key threats and risks associated with AI, and discuss practical strategies to mitigate these challenges through robust security capabilities. We’ll also examine how AI Security reshapes Identity and Access Management (IAM), and what steps organizations can take to stay resilient in this rapidly changing security landscape.

IGA modernization can be approached as an integration- and data-driven evolution of existing capabilities. IGA can be modernized through modular integration, where ITSM tools act as the user-facing front end and connect with CMDB data to provide application and service context. Through APIs, IGA can support access requests and fulfilment flows, while data is also extracted into enterprise data platforms such as Databricks for role mining, access risk insights, audit evidence, and reporting. This API enablement and data foundation can then support MCP and agent-based integrations, enabling intelligent assistants to retrieve context, trigger workflows, and guide users through policy-compliant access processes. These capabilities can be delivered with on-premise IGA solutions, while assessing whether to build custom AI capabilities on extracted data or use the IGA platform’s built-in AI tools.

As organizations transition from simple chatbots to autonomous AI agents, the traditional security perimeter shifts. These agentic systems often operate with extensive access rights and minimal oversight, creating a new risk area: Shadow AI. In this session, we explore how organizations can bring these autonomous actors together under a single, integrated identity control plane. We will discuss practical strategies for discovering unmanaged agents, assigning human ownership, enforcing least-privilege access, and ensuring full auditability. Participants will learn how to effectively manage and secure their agentic workforce while creating the foundation for the next generation of AI-driven innovation.

Identity is the new battleground, and organizations have made real progress securing human identities. Yet a critical blind spot remains: machine identities and AI agents. Machine identities now outnumber humans by orders of magnitude. They're always on, rarely reviewed, and accumulate privilege silently. AI agents are accelerating the problem. Autonomous and often over-permissioned, they operate undetected across environment boundaries, mainly because organizations operate in silos and stack point solutions instead of building a coherent model. This session cuts through the AI hype and makes the case for a holistic privilege-centric identity security approach applied consistently across human, machine, and agentic AI identities. You'll come away with practical ways to break down identity silos, get rid of blind spots, and give your security team the visibility and control they need to protect every identity and every privilege, wherever it lives.

AI agents are becoming users within your organisation. They authenticate, receive permissions and act with delegated authority, faster and at a scale no human user ever could. How we govern these agents is rightly getting a lot of attention. But there is another question that is often overlooked: where does the identity layer controlling them run, who operates it and which laws apply? If AI agents can act on everything your IAM environment allows, control over that identity layer is no longer just a compliance issue. It becomes a matter of operational security. Drawing on more than two decades of experience building identity infrastructure in the Nordics, Trivore explores what practical digital sovereignty actually looks like and how European organisations can benefit from AI without giving up control of their most critical identity infrastructure. You’ll leave with practical criteria to assess the jurisdictional risks within your own identity stack.

AI is transforming both innovation and fraud at breathtaking speed. Deepfakes, synthetic identities, automated account takeover and highly personalised scams can now be created and scaled faster than traditional, human-paced security controls can respond. At the same time, autonomous AI agents are beginning to act on behalf of people and organisations, creating an urgent new question: in a world of human and machine interactions, who – or what – can truly be trusted? In this session, Ping Identity will explore why identity must evolve into the trust control plane for every human and agent action. We will show how organisations can establish trust throughout the AI journey – from verifying identity and human ownership to controlling authorisation, preventing fraud, governing access and continuously monitoring behaviour.

Most IAM teams recognise geopolitical risk, but struggle to translate it into concrete IAM decisions. This workshop bridges that gap. Through structured exercises, participants will learn how to turn geopolitical drivers (regulatory pressure, sanctions, sovereignty, vendor dependency) into actionable IAM guardrails, risk entries and roadmap items that CIOs, CISOs and auditors can stand behind.

How do you build a future-proof CIAM strategy that actually drives business value? In this session, learn from a real-world transformation where B2B and B2C identity were rebuilt from scratch under high pressure. Discover how to balance security and customer experience, deliver quick wins with measurable ROI, and create an IAM operating model that the business actually adopts. Walk away with practical insights on turning CIAM into a growth enabler rather than a bottleneck.

Attackers no longer target just privileged passwords; they target identities. Discover why modern organizations are expanding beyond traditional PAM and adopting a broader identity-centric security strategy. Through real-world experiences and lessons learned, this session explores how to better protect privileged access in today's hybrid and cloud-first environments.

Three questions decide whether an agent's action is safe: On whose authority, for which task, and until when. And most systems cannot answer any of them. That is not because agents are new, but because the authorization underneath them was decided in advance, buried inside each application, and unable to explain itself. That held up only while access was limited by skill and everything ran at human speed. And agents removed both those limits. At Gartner in 2024 I wrote that AuthZEN was the standard to watch. It became final in January. This session covers what that makes possible, what it still does not, and five things worth doing before you buy anything.

IAMUNI is a new framework for IAM Threat Modeling, designed to bring more structure, consistency and IAM-specific context to the way identity threats are identified and assessed. But how can management and compliance risks travel from the cloud, through Digital Risk Management on the shore, into IAM Threat Modeling in the water, and then return as understandable information for management decisions? IAMUNI extends STRIDE with paired Anti-Patterns and Protection Objectives, standardised Threat Actors, reusable IAM threats, and recognised sources such as CAPEC and CWE. By connecting IAM Threat Modeling with business-level Risk Scenarios, Digital Risk Management and Enterprise Risk Management, the framework aims to bridge the gap between technical identity threats and management-level risk. And because IAMUNI is still evolving, IAM professionals are invited to challenge it: question the model, identify gaps, test its assumptions and bring in real-world IAM experience. The goal is not only to introduce IAMUNI, but to put it to the test.