Attackers used to have to hack in. Then the SaaS era taught them it was easier to log in. 

Today, in the AI era, they barely need to try as employees are pasting customer data, credentials, and source code directly into AI tools, one prompt at a time. A single misconfigured permission or a careless copy-paste can expose data you can’t pull back. 

Banning AI doesn’t work. It hurts productivity and pushes AI usage underground to personal accounts and unmanaged devices, where visibility drops to zero, and enforcement can’t be verified without observability. 

This session makes the case for a different goal: how to enable secure usage instead of blocking access, and extend zero-trust principles to how humans and machines interact with AI.

Attendees will learn how to:

• Build observability first. See which AI tools employees actually use, across both browsers and desktop AI clients, before trying to control them.
• Identify and control sensitive data in prompts. Block or redact customer data, credentials, and source code before they leave the organization. 
• Apply zero-trust to non-human AI. Govern AI agents and MCP-connected tools that can read email, query databases, and act on their own, where a single compromised instruction can turn into a major breach.
  • Turn visibility into value. Use the same observability layer to right-size AI spend and meet growing GDPR, DORA, and EU AI Act obligations around data disclosure. 

NIST wrote continuous, behavioral verification into the definition of Zero Trust in 2020: Access decisions should account for behavioral and environmental attributes, not just identity and device posture. Five years later, most implementations still verify once, at the point of access, and call that Zero Trust. ClearVector's 2026 Identity Intelligence Report shows what that gap actually looks like in production: 91% of identities running there are non-human, and the adversary increasingly relies on stolen but valid credentials that clear the same checkpoint as legitimate ones, moving undetected because nothing after login tells the two apart. AI widens the gap further, since an agent that inherits a developer's already-verified session can act for hours without ever being re-checked. John Laliberte, CEO of ClearVector, walks through where Zero Trust's own founding principle stops being practiced, using a real production incident as the anchor, and what it takes to build a pattern of life for an identity so verification never actually stops.

Organized attackers aren’t breaking in, they’re becoming part of your extended workforce. AI-powered impersonation, deepfakes, hiring fraud, and MFA fatigue attacks now target corporate employees, frontline workers, contractors, and partners—across onboarding, access, and helpdesk workflows. As organizations expand across hybrid work and third-party ecosystems, identity has become the most exploited, and least consistently verified, attack surface. The problem? Most organizations still rely on implicit trust, assuming identities are legitimate after a single check, while attackers continuously impersonate, infiltrate, and escalate. According to IDC, over 80% of breaches are identity-driven, and organizations that adopt continuous, contextual identity verification achieve up to 43% reduction in fraud loss and 47% faster onboarding.

We’re now taking a break!

Take this opportunity to visit the Exhibit Hall and explore our sponsors’ resources, solutions, and latest insights. Their subject matter experts are available now and ready to answer your questions and connect with you. Be sure to stop by before the next session begins!

AI is changing the role of identity across the enterprise. Human users are no longer the only actors interacting with sensitive systems and data — AI agents, copilots, APIs, and autonomous workflows are introducing new layers of access, intent, and interconnected risk.

In this session, we’ll explore why identity has become foundational to understanding AI risk, how AI changes traditional assumptions around access and trust, and what new attack paths emerge across connected systems. We’ll cover real-world scenarios involving intent, lateral movement, and overprivileged access, along with a practical framework for thinking about identity in the era of AI — and where organizations should begin.