We’re mirroring what we did in the terrestrial world. Industry-wide guidelines are emerging so that all companies and suppliers build and secure space technology using the same checklist. Intrusion Detection Systems (IDS), Intrusion Prevention Systems (IPS), Endpoint Detection Protection and Response (EDPR), and antivirus software are all being deployed in space. The challenge is power and bandwidth, because you don’t have a massive computer up there. And with the advent of AI, our adversaries in space are good, and they are moving at a pace that has no boundary.

—Greg Oslan, Chairman and CEO, National Cybersecurity Center

Firstly, different identity types suddenly have different demands and ways they need to be managed, with different policies and controls to be put in place. It’s just a different life cycle. A system that was designed even five or 10 years ago was largely focused on humans. But eventually identity teams run out of budget and bandwidth to customize these old systems to handle machine identities.

Second is this new mandate to understand why every account in the enterprise has the access it does. Does it have an owner? How can teams find those accounts and associate them with the right business processes at scale? Legacy systems just weren’t designed to operate at that level.

—Chris Gossett, Chief Growth Officer, SailPoint

We’re in the middle of a transformation into an AI-native workforce. So even the most talented team of software engineers and software development people still have a distribution of early adopters and late adopters.

Somebody who two years ago might have been director of software development, a star on the team—if they’re not leaning into AI today, they’re already falling behind. The challenge for leadership is how to help people realize the urgency in which they have to change.

—Yotam Segev, Co-Founder and CEO, Cyera

I believe identity is very fragmented and fractured. You have identity and access management (IAM) on the side. You have privileged access management, which is identity just behaving like a privileged user. And then you have things like identity governance and so forth. There are too many small, disconnected islands.

I believe identity needs a singular platform. I believe identity needs a control plane. It needs a platform where identity verification or identity governance become apps on a platform.

—Tarun Thakur, GVP and GM, Identity Security, ServiceNow (formerly Veza)

What are these identities? It’s software. That software is being created. Where? In somebody’s laptop. They’re using AI. The new challenge is to figure out a way to protect the code that’s being written in real time.

The next bastion is agentic scanning. Threats are no longer something companies can worry about six months from now—they happen instantly. If an AI makes a mistake (a “hallucination”) inside a security system, it might accidentally grant the wrong access to the wrong system. Soon, organizations will struggle to know what data, systems, or identities they can actually trust.

A major vulnerability is that different tech teams (hardware, identity management, security operations) often do not talk to each other. They see the same problem in isolation instead of working together.

CISOs have an incredibly difficult job because they have to prevent every single attack. To get the necessary resources, they must clearly communicate these new AI realities to their CFOs to secure the proper budget for defense.

—Daniel Campbell, President of North America, Palo Alto Networks

First, find every hidden AI. Most organizations have hidden agents in their ecosystem. It might be running on a developer’s laptop. It could be hidden on a Kubernetes cluster. Some agents, like interactive agents, are easier to find. Don’t stop your discovery just with that. Deeper analysis includes the agents running on your servers or on your computer.

Second, treat AI like employees. Make sure you have a blueprint of how agents are coming into your ecosystem, how they’re getting terminated, and what access you are removing.

Third, monitor what AI has access to. Are agents only touching systems and data they’re supposed to? You can’t just define the access; you have to enforce it as well.

Fourth, talk to your board. Explain to the board why identity is the cornerstone of this era. In the future, successful organizations will design everything in digital workflows, keeping identity at the center.

—Vibhuti Sinha, Chief Product Officer, Saviynt

One real example is a customer I had who was more mature in agentic workflows. They have agents in their environment making 45,000 cloud API calls in one hour. And there is a chance one of these agents can go rogue, maybe try to find an additional way of accessing the database. That can wreak havoc in your ecosystem.

It’s difficult because it means on top of the agents making the calls, you also need agents to monitor what’s happening. There’s no human who can actually monitor that many calls.

I think it’s something that we have to keep in mind when we move to this future. There are new types of threats and there are new types of incidents, and we must be ready for that. We need agents that can reduce the risk that might come from these new processes.

—Alon Schindel, VP of AI & Threat Research, Wiz