Name: Micro Authorizations: Enabling Zero Trust in PAM
Start: 2024-04-09T15:14:00Z
End: 2024-04-09T15:14:35.000Z
Location: BrightTALK

This channel brings together the leading identity and security vendors and industry experts to regularly educate security leaders on how to reduce risk through identity-centric strategies. For more resources and education on identity-centric security strategies, visit www.idsalliance.org.

Every major breach headline today shares a common flaw—authentication that trusts too much. Attackers don’t need advanced exploits, they simply log in using social engineering, phishing sites, or real-time relays that manipulate human behavior. Employees feel protected by MFA apps and codes, yet those same tools are being turned against them. The weak point isn’t technology failure—it’s misplaced trust. MFA methods that depend on user judgment, shared secrets, or remote approvals are now the open door into the enterprise. In this session, we’ll expose why the tools once considered secure have become the attacker’s favorite weapon.

What Is Causing MFA and Auth Apps to be Compromised?

The IDSA Machine and Agent Identity Working Group will preview the initial work, including the Threat Analysis, Use Cases, and the Maturity Model. This is an opportunity to see the framework firsthand and gain the tools necessary to operate securely in a machine-driven world.

Attendees will learn:
-Actionable Use Cases & Threat Analysis: Real-world scenarios to guide your strategy.
-Maturity Model & Success Metrics: A defined path to measure progress and demonstrate value to stakeholders.
-Reference Architecture & AI Agent Framework: Blueprints for securing the next generation of digital entities.

Blueprint for Machine and Agent Identity

Hybrid IT has pushed traditional SSPR to its limits. Users still get locked out, systems fall out of sync, and identity teams burn time fixing the same issues on repeat. According to the Identity Defined Security Alliance’s 2025 report, hybrid complexity is now the biggest obstacle to securing identities, and inconsistent credential control is a major source of user friction.

This session explores what comes next: enterprise-controlled credential management that delivers predictable access for users, reduces operational load for IT, and finally moves password recovery and governance into a modern, scalable model.

Attendees will learn:
- How Passwords as a Service centralizes creation, rotation, sync, and recovery across Microsoft, SaaS, on-prem, and legacy systems
- How modern mass password reset works and why it matters for baseline credential health
- Practical steps to reduce password noise and improve user experience immediately
- How to standardize governance and maintain reliable access across complex environments

What Comes After SSPR: Reducing Password Friction and Re-Establishing Control in Hybrid Environments

Providing developers and operators with timely and secure access to production servers is critical. Yet legacy approaches like jump hosts and static SSH keys, create standing privilege, developer friction and compliance gaps. In this session, we’ll explore how modern identity-native approaches can deliver just-in-time SSH and sudo access to virtual machines across cloud and on-prem servers and databases.

Attendees will learn how to eliminate standing access, tie every session to your organization’s IdP, and deliver a seamless developer experience - all without relying on the complexity or maintenance of vaults, static credentials or bastions. Walk away with practical strategies for securing privileged access while keeping teams productive.

Eliminate Static Credentials: Just-in-Time SSH/Sudo Access to Virtual Machines

Zero Trust started as a way to protect human users logging into applications. Over the past decade, it has expanded to workloads, cloud services, and machine identities. Now, with the rise of agentic AI, enterprises must confront a new challenge: how do you apply identity-driven security to autonomous systems that act, decide, and interact on their own?

In this session, Chris Owen (dotNext Europe) and Apurva Dave (Aembit) trace the evolution of Zero Trust through the lens of identity. From workforce IAM to PAM, from service accounts to non-human identities, and now to AI agents, they’ll map the journey — and the pitfalls. They’ll show how legacy approaches break down, and how organizations can evolve toward policy-driven, workload-centric, AI-ready identity models.

Attendees Will Learn:

– How Zero Trust has evolved—from securing humans and workforce IAM to workloads, APIs, service accounts, and now autonomous AI agents.

– Real-world patterns and pitfalls organizations face when adapting Zero Trust to non-human identities.

– A practical framework for “AI-ready Identity & Access” and how policies can govern machine-to-machine and agent-to-agent access.

Zero Trust and Identity: Evolving from Humans to AI

As AI agents grow more autonomous, from initiating workflows, accessing sensitive data, to making decisions in real time, they challenge the core assumptions of traditional identity and access governance. In this session, Miguel Furtado explores how AI shifts the perimeter from identity to intent, and why modern IAM strategies must evolve to continuously evaluate agent behavior, authorization scope, and data access patterns. We’ll discuss what defines a true agentic AI, how intent-aware governance can fill today’s visibility and control gaps, and what practical steps can be taken to secure non-human identities and AI agents today. If identity is the control plane of the modern enterprise, intent is its next policy layer.

Rethinking IAM with Intent:  Identity Governance in the Age of AI

Standing access is a time bomb—and yet, in most orgs, it’s still the default. Developers are over-permissioned just to avoid ticket delays. Access reviews live in spreadsheets. Security teams are buried in manual cleanup and audit prep. And the patchwork of point tools meant to help? They rarely scale—or align with how your teams actually work. This session is for the teams who are asking: Is what we’re doing even working anymore? We’ll walk through a practical, field-tested approach to implementing Just-in-Time (JIT) access—starting with what you already have, proving value with one team, and scaling without creating friction.

From Tickets to Trust: How to Roll Out Just-in-Time Access without Slowing Down Engineers

Credential theft, malicious insiders, orphaned accounts—identity-based attacks have become the leading cause of breaches, while regulatory pressures demand continuous proof of security controls.

Modern Identity Governance and Administration (IGA) has evolved from cumbersome, compliance-driven implementations into streamlined, automated defense systems that safeguard enterprises at scale.

In this webinar, Omada Field Strategist Thomas Müller-Martin will reveal the 5 IGA Essentials to Strengthen Your Cybersecurity Strategy, a proven framework for transforming identity governance from reactive compliance to proactive threat prevention.

What you’ll learn:
-Recognize today’s most critical identity threats and their real-world impact on regulated enterprises
-Master the 5 IGA Essentials that enhance cybersecurity posture while simplifying operations
-See how modern IGA solutions automate threat detection, enforce least privilege, and scale across complex global environments

Join us to discover how leading organizations leverage these essentials to prevent breaches, maintain continuous compliance, and protect their most critical assets without sacrificing business agility.

The Cybersecurity Fast Track: 5 IGA Essentials to Reduce Risk

As AI adoption accelerates across organizations, traditional security approaches focused solely on license management and non-human identities are missing the bigger picture. This webinar explores a comprehensive framework for AI security that recognizes the full spectrum of AI identities in your environment, from AI users and builders to AI agents, and provides actionable strategies for discovery, protection, and defense.
We'll examine how AI security can be looked at through an identity security lens and demonstrate how runtime intelligence reveals dramatically more AI usage than static configuration approaches. Attendees will learn practical methodologies for inventorying their complete AI footprint, identifying risky access patterns, and implementing high-fidelity detection capabilities that enable faster SOC response.

AI Users, Builders, and Agents: Securing the Next Generation of Identities

By March 2026, public TLS certificate lifespans will halve—and eventually shrink to just 47 days by 2029—driving urgent change in how organizations manage certificate renewals, and ultimately, digital trust. TLS certificates are the machine identities that underpin secure communication on the internet. Manual certificate tracking at the scale demanded by 47-day renewals simply won’t be feasible. And without automation, shortened lifecycles increase the risk of outages and compliance failures. Now is the time to implement a modern, automated certificate management strategy to safeguard trust, ensure compliance, and keep pace with the internet’s accelerating demands. You'll leave the session with practical guidance on how to:
- Modernize your certificate lifecycle management with scalable automation
- Align risk communication across technical teams, leadership, and the board
- Budget for the transition and articulate the cost of inaction
- Prepare your infrastructure for continuous 47-day renewal cycles, essential for public PKI and increasingly valuable for internal systems

From Chaos to Control: Automating Machine Identity Security Before the 47-Day Certificate Deadline

Salt Typhoon proved that attackers are exploiting identity blind spots in the network layer to bypass controls and move laterally. This session explores how traditional PAM and NAC tools leave routers, switches, and firewalls exposed, and why identity-first security must extend beyond IT systems. We’ll break down the attack path, highlight key lessons from Salt Typhoon, and show how applying Zero Trust principles at the network layer can stop similar breaches before they start.

Zero Trust Falls Short Without Network Identity: Lessons from Salt Typhoon

A single stolen password can bring your business to its knees — unless you can recover in hours, not days. The first 72 hours after a credential breach determine whether you contain the incident or face a full-scale crisis. Regulatory mandates, cyber insurance requirements, and customer trust all demand rapid recovery, yet many enterprises still rely on password management processes that take days. This session introduces a vendor-neutral, identity-first framework for 72-hour recovery, covering detection, containment, and large-scale access restoration while ensuring compliance. You’ll leave with a clear, adaptable roadmap to strengthen resilience, minimize downtime, and align identity practices with today’s threats. Identify the compliance, insurance, and business pressures driving the 72-hour identity recovery window. Master the critical steps for rapid detection, containment, and large-scale credential restoration. Avoid the hidden process and technology gaps that turn hours into days. Measure your organization’s recovery readiness against industry best practices — and know how to close the gap.

72-Hour Recovery Plan for Enterprise Password Management

Learn how your organization can join Cybersecurity Awareness Month this October. This webinar will walk you through the 2025 campaign theme, key messages, and the suite of free resources available to help you raise awareness within your organization and beyond. From simple social media posts to full-scale internal awareness campaigns, this session will equip you with the knowledge and materials you need to make an impact in your organization.

Attendees will learn:
• The ready-to-use tools and templates available to support your campaign
• Creative ideas for engaging employees and building a culture of cybersecurity
• Tips for aligning your campaign with the broader national effort

How to Get Involved in Cybersecurity Awareness Month

As identity becomes the new security perimeter, the urgency to modernize identity governance is growing but evaluating IGA solutions can be complex, especially with evolving cloud architectures, regulatory demands, and rising security expectations.

In this practical session, Omada will walk through a framework for evaluating Identity Governance & Administration (IGA) solutions, grounded in real-world RFP guidance. You’ll learn how to frame your requirements, identify deal-breakers early, and ask the right questions to avoid costly missteps.

Attendees Will Learn:
• Key considerations for choosing a modern IGA solution (scalability, integration capabilities, usability etc.)
• Practical insights for comparing vendors
• Must-ask evaluation questions to uncover platform maturity and vendor fit
• Tips for selecting the right solution for your organization

Whether you're planning a formal RFP or assessing your current solution, this session will help you take a structured, security-aligned approach to choosing a modern IGA platform.

Evaluating IGA Solutions: Questions to Ask in Your RFP

Since we always lack budget and resources then what's the strategy? We can't do it all but there is an approach that will help you meet today’s security challenges whether you have a team or not.

This session digs into this security strategies, both practical and controversial, and a lot more as Den Jones, Founder & CEO at 909Cyber, provides some proven tested strategies that help thwart today's attacks.

What's Your Security Strategy?

Machine identities—from service accounts to cloud secrets—are exploding in number. Yet most compliance programs can’t keep up. In this hands-on walkthrough, you'll see how Segura provides complete visibility, policy-based automation, and audit-ready reporting for machine identities. Watch a live demo, hear expert commentary, and leave with a roadmap to protect non-human access and simplify compliance.

Attendees Will Learn:
– How to identify and inventory machine identities across hybrid and multi-cloud environments
– How to apply privileged access and secrets management to control non-human identities
– Real-world examples of how to automate discovery, policy enforcement, and auditing
– How to bridge the gap between DevOps, security, and compliance for continuous oversight
– Which metrics and tools are essential for aligning machine access with SOX, ISO 27001, PCI-DSS, and NIST compliance requirements

Simplifying Machine Identity Compliance - Live Walkthrough

It’s no surprise tech investments in Artificial Intelligence (AI) and cybersecurity are on the rise. The top priority for C-Suite (52%) is to speed up digital transformation, and now security leaders must tackle a new, exploding attack surface – machine identities & AI agents – while breaking silos and doing more with less.

Identity is at the center of this rapid change. Today, machine identities outpace humans by a ratio of 82:1. Join us live as CyberArk Chief Strategy Officer Clarence Hinton explores trends, market dynamics and other pressing issues shaping the 2025 identity security landscape.

Identity Security in 2025: Top Trends from 2,600 Security Decision-Makers

Disconnected applications pose a significant challenge to identity lifecycle management, often operating beyond the reach of traditional identity governance platforms. This results in risks like orphaned accounts and compliance gaps. In this webinar, Henrique Teixeira (SVP of Strategy at Saviynt) and Belsasar Lepe (CEO of Cerby) will explore why addressing this “last mile” is crucial. They will demonstrate how integrating Saviynt’s governance framework with Cerby’s automation platform enables end-to-end access governance—without the need for APIs or SCIM.

Attendees Will Learn:
-Why disconnected applications create critical identity governance challenges
-How automation addresses the “last mile” in identity lifecycle management
-The benefits of integrating Saviynt’s governance with Cerby’s automation platform
-A demonstration of a joint solution enabling access governance without APIs or SCIM
-Insights into the future direction of identity governance

Solving the Last Mile in Identity Lifecycle Management: Why Automation Is the Future

Decentralized Identity standards and technologies are moving into the mainstream, whether mentioned explicitly in recent EU digital identity frameworks or re-packaged as "Reusable Identity" to focus on its benefits to onboarding. Kim Duffy, Executive Director of the Decentralized Identity Foundation, covers the key principles and tech behind decentralized identity, trends in adoption, and compelling use cases demonstrating how it can enable a trusted ecosystem, whether you're interacting with people, organizations, devices, or a complex chain including all of these.

Decentralized Identity for People & NPEs: Updates, Trends, & Killer Use Cases

In today's rapidly evolving business environment, the significance of identity security cannot be overstated. With both employees and non-employees having access to critical applications, data, and infrastructure, the need for robust identity security measures has never been more pressing.

Navigating Threats & Solutions in The Age of AI-driven Business

As the digital identity landscape continues to evolve at a rapid pace, understanding the needs, skills, and diversity of its practitioners is crucial for steering the industry towards a more inclusive and effective future. Join Heather Flanagan, Executive Director for IDPro and Principal Editor for the IDPro Body of Knowledge, for a sneak preview of the 2024 IDPro Skills, Programs & Diversity Survey results. This session aims to shed light on the current state of the digital identity industry, highlighting key trends in practitioner skills, program development challenges, and the critical importance of diversity in fostering innovation. [Optional Add] Participants will gain valuable insights into: - The emerging skills and expertise areas in high demand within the digital identity field. - Strategic guidance for individuals seeking to advance their careers and for organizations aiming to strengthen their identity management programs. - The role of diversity in driving technological and service innovation, and how organizations can tap into emerging opportunities. - Strategic guidance for businesses looking ahead to future opportunities and challenges in the world of digital identity.

Insights from the 2024 IDPro Skills, Programs & Diversity Survey

Some cloud identity providers have been at the center of high-profile breaches as modern threat actors have been heavily targeting the identity layer of cloud. Many security teams simply don't have visibility into attacks wagered against the identity control plane. In this session, learn how threat actors target the identity control plane and how to secure your IdP to better protect your environment.

Observations from Real-life Attacks & Measures to Protect Your Environment

Recent security breaches, exemplified by incidents such as Cloudflare's, serve as a stark reminder of the inherent security in unmanaged Non-Human Identities (NHIs), such as service accounts, service principals, tokens, secrets and keys. These breaches underscore the complex operational hurdles even the most seasoned security teams struggle to overcome when it comes to governing and securing NHIs. While enterprises have rolled out programs to fortify the security of human identities, most lack a strategy and solution for NHIs.

Securing Non-Human Identities: Insights from Recent Breaches

For three years running, the most popular way people say they keep track of their passwords is by writing them down in a password notebook, according to the National Cybersecurity Alliance's annual Oh Behave! Cybersecurity Attitudes and Behaviors Report. We'll talk about those findings and more gleaned from surveying the public in the US, UK, Canada, Germany, France, and New Zealand.

People ❤️ Password Notebooks

We will cover how Identity GRC can serve as a strategic pillar in a firm’s cybersecurity strategy, providing robust tools and methodologies to safeguard digital assets, proactively managing identity-related risks to simplify compliance efforts and optimize cybersecurity posture.
We will discuss real-world examples to give insights into best practices for implementing Identity GRC effectively. By embracing this powerful approach, firms can learn to not only protect their digital assets but also thrive in the ever-changing cybersecurity landscape.

Leveraging Identity GRC to Supercharge Your Security Strategy

The OSIA (Open Standards Identity APIs) initiative to drive interoperability of identity systems has been adopted globally by the industry and leveraged as part of wider foundational identity schemes by a growing number of countries.

This presentation will introduce how to leverage OSIA to drive interoperability through identity ecosystems.
– Unleashing market innovation through interoperability
– Leveling the playing field to open markets and drive competition
– Ensuring product(s) compatibility after M&A activity

Introducing OSIA: a Universal Interoperability Framework

Get in the minds of Criminals, Nation States and Hacktivists.  Join us to explore the psychology, motivation, and cutting-edge tactics of today’s threat actors.  Our dynamic resident experts, Andy Thompson, and Brandon McCaffrey will unravel the intricacies of recent attacks and evolving threat methods that jeopardize your organization.

Modern Battlefield: Attacker Methods, Motivations & Building a Strategic Defense

The traditional security model of "trust but verify" is no longer sufficient in today's complex and dynamic threat landscape.
Zero Trust is a security concept that assumes that threats exist both inside and outside the network, and no entity should be trusted by default.

Zero Trust: Why It Matters and How to Implement in Your Organization

The landscape of customer/citizen service access is undergoing a paradigm shift, driven by the imperative to establish comprehensive identity and authorization lifecycles. This presentation delves into the common structures and diverse global approaches to Know Your Customer (KYC) and Customer Identity and Access Management (CIAM). By understanding the evolving requirements of service providers across various use cases and geographies, attendees will gain insights into the intricacies of identity management. Furthermore, this session will review customer and citizen journeys, from initial onboarding to continuous authentication, KYC refresh, and step-up CIAM, shedding light on the critical change factors and emerging trends in the field.

Key Points:
– Analysis of common structures and diverse approaches to KYC and CIAM across industries and regions.
– Service Provider Requirements: Addressing Identity Management Needs Across Use Cases and Geographies.
– Customer and Citizen Journeys: mapping out the customer and citizen journeys, starting from the onboarding process to continuous authentication, KYC refresh, and step-up CIAM.
– Identifying Key Change Factors and Trends in the field of identity management.
– Through this presentation, participants will gain valuable insights into the complexities of identity and authorization lifecycles, the importance of collaboration in establishing unified frameworks, and the strategies for navigating the evolving landscape of customer service access.

Evolving Customer Service Access: Holistic Identity and Authorization Lifecycle

Cloud, AI, and connected devices have blurred the boundaries of trust. Public key infrastructure is key to staying ahead, defining trust. 72% of organizations say that PKI and machine ID management present serious problems, resulting in outages, incidents, and audit failures. We’ll discuss insights, including PKI and machine IDs in modern IT, threats and trends, and the state of quantum-readiness.

Key Takeaways from the 2024 State of PKI & Digital Trust

In an era where digital interactions dominate our daily lives, the concept of identity management is undergoing a profound transformation. From centralized to decentralized approaches, governments are reevaluating their strategies to adapt to the changing landscape. The emergence of W3C standards brings both opportunities and challenges, prompting governments to tread cautiously. 

This presentation explores the migration towards wallet-based digital identities, highlighting the shift from centralized to decentralized models and multi-modal approaches. Moreover, it examines the evolving concept of user-centricity, placing the wallet at the heart of individuals' interactions as citizens, employees, customers, and beyond.

Through this presentation, attendees will gain insights into the evolving landscape of digital identity management, the role of governments in driving decentralization, and the transformative potential of wallet-based identity solutions in fostering user-centric experiences.

Key Points:
– Centralized vs. Decentralized and Multi-Modal Approaches: Governments' Transition
– Navigating W3C Standards: Government Prudence in Implementation
– The Wallet: Pivotal in Achieving User-Centricity Across Various Domains
– Showcase of innovative use cases demonstrating the transformative impact of user-centric wallet-based identities.
– Best practices for ensuring the authenticity and integrity of various types of digital documents within the wallet ecosystem.

Embracing the Next Generation Digital Identity: The Migration to Wallet

There is a lot buzzing across the global Identity landscape. Come geek out with us while we hit the top 10 themes, and find the humorous side of our “wins and losses” as new technologies shake out. 

Enjoy the inside track as the OpenID Foundation takes you from the main stage to the back channels of our trade.

Top 10 Digital Identity Trends from the OpenID Foundation

This presentation will focus on the emergence of generative AI and how it compels us to revisit the fundamental principles of identity in the digital age.

Identity Reboot: Generative AI as a Catalyst for Change

Identity today is not what it was a decade ago. Changes in the technology & regulatory landscape, user behavior, and organizational priorities have transformed it from a compliance-oriented discipline to a business enabler — and often a board-level initiative. It has also become the first step to adopting a modern Zero Trust security model. 

The latest technology has accelerated the need for identity transformation by impacting the way identity is perceived, practiced, and envisioned. These trends include technology convergence, cloud transformation, software simplification, intelligent automation, and business readiness. Identity is further influenced by adjacent security areas, such as SASE, CSPM, and CyberMesh. So how do you navigate this complex landscape and set your organization up for identity security success? Join us for this live webinar to find out. 

In the process, you’ll learn about:

* The leading factors influencing identity transformation
* The top trends driving change (and even some predictions too) 
* The benefits of modernizing IAM solutions and practices
* The biggest lessons learned by organizations on the other side
* The most common pitfalls and strategies to consider

Navigating the Modern Identity Landscape: Successful Transformation Strategies

Identity Management Day 2024

The Authorization Fabric decides whether a specific principal is authorized to perform a precise operation on a particular resource and whether the resource permits this access.The granularity of this approach is vital in today’s threat landscape, requiring organizations to shift their focus to a comprehensive, system-wide authorization framework. This shift parallels the principles of microservices but applies them to the realm of access control. Rather than depending on a single point of control, there is a need for a network proxy that acts as a bridge between trust and authorization. Join us on a journey towards a future powered by micro authorizations, where precision, adaptability, and contextual awareness define access control. Explore how micro authorizations can address contemporary security challenges and facilitate the adoption of the Zero Trust model.

Micro Authorizations: Enabling Zero Trust in PAM

Zero Trust

Privileged Access Management

Cloud computing has exploded over the past few years, delivering a previously unimagined level of workplace mobility and flexibility. The cloud computing community on BrightTALK is made up of thousands of engaged professionals learning from the latest cloud computing research and resources. Join the community to expand your cloud computing knowledge and have your questions answered in live sessions with industry experts and vendor representatives.

Cloud Computing

The IT security community on BrightTALK is composed of more than 200,000 IT security professionals trading relevant information on software assurance, network security and mobile security. Join the conversation by watching on-demand and live information security webinars and asking questions of experts and industry leaders.

IT Security

Increasing expectations for good governance, effective risk management and complex demands for corporate compliance are presenting a growing challenge for organizations of all sizes. Join industry thought leaders as they provide you with practical advice on how to implement successful risk and compliance management strategies across your organization. Browse risk management resources in the form of interactive webinars and videos and ask questions of expert GRC professionals.

IT Governance, Risk and Compliance

The application development community features top thought leadership focusing on optimal practices in software development, SDLC methodology, mobile app development and application development platforms and tools. Join top software engineers and coders as they cover emerging trends in everything from enterprise app development to developing for mobile platforms such as Android and iOS.

Application Development

Enterprise applications have become a crucial piece of infrastructure for many businesses. The enterprise applications community on BrightTALK features the latest insights in enterprise application integration, enterprise application architecture and EAS software. Join the community to gain access to thousands of videos and webinars presented by recognized enterprise information systems experts and arm yourself with the knowledge you need to succeed.

Enterprise Applications

As an IT professional, many of the problems you face are multifaceted, complex and don’t lend themselves to simple solutions. The information technology community features useful and free information technology resources. Join to browse thousands of videos and webinars on ITIL best practices, IT security strategy and more presented by leading CTOs, CIOs and other technology experts.

Micro Authorizations: Enabling Zero Trust in PAM

Presented by

About this talk

Identity Defined Security Alliance