Identity in the Uncertain World of AI

Hi. Okay. So so today, I got a lot of questions for you. I don't have all the answers. Setting the stage upfront. So first, who... Who's present at our conference before? Raise your hand. Okay. Okay. So you know how I'm feeling right now. Alright. This is this is my fourth time and I'm really excited to be here, But just give me some grace. Okay? So now that we set the stage, I I do have to start by being honest about something. Okay? I lied. A few months ago, I was on a stage much like this one. I put three photos of myself up on the screen. I let a whole room of smart people decide whatever they wanted to about me. Right? They were sure they had me figured out, but they were wrong. I think this crowd could do better. So let's play again. Alright. Surely, all of you know this game, two truths and a lie. I'll show three photos of myself. Two of them are true. One of them is fake. Your job is to spot the lie. Okay? And since I'm a security person, much like everyone here, I have to be honest about something. All three of the photos have been run through AI, polished, enhanced, smooth. So what makes it the harder version? Okay? So first, I've run a... I've completed a triathlon. Second, as a little girl, I used to own two pet pigs and a goat. And finally, I can play the piano. What do you think is? Yell it out. This is going to be interactive. Yell it out. One. One. One's a lie? Three. Three. I can't play the piano? All all three are the lie. Yeah. All three. Yep. Well, here are the real photos. Did that clarify anything? Are are you confident you know what is the lie yet? We're on triathlon, two pet pigs and a goat, piano. Counting of the animals is off. Okay. You know, it's a little difficult to get all three in frame. I can't exactly go back in time and tell my parents to try a little better. Alright. So here's the lie. Number three, I cannot play the piano, not a note. I own a keyboard. I've sat at it. I've photographed myself at it. You know, none of that ever turned into a plane. So the photo was a signal. The claim I can play the piano was a signal, but the identity, pianist, now it comes from repeated behavior over time. Right? Identity follows action. You just judge a stranger sitting here with your full attention, your gut. Who who am I? You can't reliably tell it from a few seconds. So identity isn't what we say, it's what we do. So here's the part that should bother you. We all have a digital twin and you just didn't create it. Let me actually introduce myself. I'm Melissa Cronquist, software principal engineer at Walmart Global Tech. I'm on the Infosec AI security and safety team. Another lie, it does say thirteen years at Walmart and... But today actually marks fourteen years at Walmart. So my entire career at one company started, I like to call it the enterprise foundation years to where, you know, I learned what cybersecurity is, how to deploy software, how to, you know, pass through code through SDLC, and then I was lucky enough to get my break in Directory Services. But once wasn't enough, evidently. If if you've ever lived through an Active Directory migration, you know, that sentence has a lot of quiet suffering. There's a specific dread in finding an account running production authentication labeled temp from 2011, leave the team, do a few other things, come back, and two years later, guess what? Same account. It's still there running production authentication. Still labeled temp. You know, at this point, I think it has more job security than I do. So anyway, a few things about me that I've learned along the way, those fourteen years. Trust is earned at every request, not once at the door. Fundamentals beat complexity every single time. And a personal one, comparison is a thief of joy, which let me tell you, it's a handy thing to believe when you race triathlons and finish mid pack. And so, yes, that was true, number one. But I'm not here to tell you what I believe. I'm here to challenge three things that you probably believe. First, your identity stack was not built for this moment. The attacker does not need your password anymore. And finally, we've been asking the wrong question the entire time. So if you couldn't reliably tell what was true about one person from a few photos with what what I hope was your full attention, your gut, your human brain. How how can you do that for millions of identities in milliseconds? Humans, we get to fail gracefully. We guess, we laugh, we move on. Systems do not get to laugh. Systems fail catastrophically. Now, this is a question I get asked most often, and it's typically at a play date when another parent finds out what I do for a living. Right? And let me tell you, it's never as straightforward as, so is authenticity dead? No. But let me give you some insight into how that conversation goes. Right? So we're saying that our birthday party and a parent will will ask me, so how easy is it for my my kid's voice to be faked or cloned and, you know, my son's face altered and a stranger uses it. And, you know, as a mom of three boys, not much faves as me. I always give it to a straight. And and so at that point, I see them questioning their entire relationship with the Internet, you know, over a juice box at a birthday party. And once once they come to the realization, then it does end up some form of this question. So is this the end of authenticity? What can we expect? And, you know, funny enough, I've I've always been invited back. So evidently, I'm still in good company even after I ruin a weekend. But this this is not rhetorical, this question. It literally happened to me last Wednesday when I was meeting a parent for lunch. So AI can clone voices, faces, behavior. What happens then to real when anything can be convincingly faked at scale? Faces, voices, behavior, all of it's synthesizable now. You know, they say it only takes three seconds of audio required to emulate a voice. And, you know, as a mom, I I like to think it would take more more than three seconds of my son's voice to fool me. But, you know, I I do believe that three seconds would be enough to fool a coworker, a casual acquaintance, someone who's close enough to know your voice, maybe not looking out after a fake. Right? But the real risk isn't how realistic it is. It's as realistic and industrialized. AI makes it cheap, fast, endlessly repeatable. Here's the reassuring part though. One impressive fake is only a data point. It's not identity. One fast race doesn't make someone a runner. Repeated training does. Ask me how I know. So the attackers did the obvious thing. They leveled up. Fraud stopped stealing credentials and has started manufacturing credibility. Identity follows action, and now the action can be manufactured too. That's the whole game changing underneath us. This brings us to the real structural shift. Identity is moving from a moment to a measurement. The old way, static verification. One check out the door, yes or no, that must become continuous confidence. Always on, context aware, a score instead of a gate. Now I've always... I don't know about you, but I've always found the term context aware a bit abstract, so let's walk through that a bit more. A modern confidence score is a... Did the password match? It's device posture. Is this a laptop or is it a burner? It's about your location. Did you log in or did you scan your badge to get into the office at 08:00 in Nashville, but then log in from Tokyo at 08:05. It's session behavior, how you actually move through the app versus how a script or an agent moves through an app. No. None of those signals prove anything. Stack 12 of them on top of each other and you're starting to get something worth trusting. One of them is just an expensive coin flip. So here's why this is you in the third row problem and not just a security problem. Identity failure is a force multiplier. It may start with losing access but will always turn to your business losing money and losing reputation. Identity failure never breaks in isolation. So let me say the uncomfortable part out loud. Authenticity was never a fact. It's always been a probability. Username, password, what's your mother's maiden name? The human fuzzy, you know, contextual stuff, that's that's where we were forcing a yes or no answer. Right? And it worked because faking signals used to be expensive. AI makes them cheap, abundant, and fast. So confidence has to be inferred, not proven. Any single signal can lie to you. Confidence is what we build from consistency over time across a lot of signals at once. So classic AAM, identity and access management, the world that I grew up in, the rest are on three pillars. So stable humans, only people act like identities. Stable signals, faces, voices, documents were expensive to fake. Stable intent, your behavior reliably reflected who you were. None of those were wrong before. They were just true because faking them cost too much. We already know AI changed the math. So let's let's play the game one more time, except now I'll show you how the trick is built. So here's the real one. Company fame... Fundraiser, I paid $20 at my office to get this headshot taken of me. Right? So camera, lenses, actual me. So it it feels almost quaint at this point. Right? Next, clothing swap. Same face, same everything, new shirt. This one is the cheapest fake there is. You're dangling and blink. Attribute edition. I am now wearing a tiara I have never owned. Still don't blink. That could be me. Alright. Now we're getting a little ambitious. Possible content. Look at that though. I can play the piano again. Twenty minutes ago, did I say that was a lie? So here's the model quietly making a... Me a liar twice in one talk. Alright. High detail synthesis. So there's a room, a crowd, someone's drink is in frame. Right? And the model didn't just fake a photo, it reinvented an entire night for me to be talented at. Alright. Implausible content. Right? You you all see it. You can tell. Call it out at sight. Same piano skills, new venue, the moon, Steinway included, astronaut unbothered. So everyone before that photo, you already told me at the beginning, you didn't know if it was true, the photo. The last one you can call out on-site. Realness and probability... Plausibility, I mean, used to move together, and that's not how it works anymore. So three mechanisms that broke the pillars. First, generative impersonation. When artifacts get cheap, they stop being evidence and they become decoration. A convincing fake, a clean looking document, pretty and proof of absolutely nothing. Synthetic identities is mechanic too. These don't win by looking flashy. They win on the precise, boring, repeated detail, specific enough to pass every check you have, stitched together from real and invented data. Sometimes the attacker doesn't bother stealing you. They just build a new person that the system can replace you with. Third, this is a p a. I know coming back to haunt all of us. We got clever, moved on to behavioral signals, typing cadence, session flow, decision rhythm, the stuff that felt too mute to fake. Problem is, AI can practice your behavior faster than you ever did, and once it has to the system, it simply is you. So where does the whole thing actually break? There are three layers. The signal layer, device posture, network behavior artifacts, layer two, decision layer, risk scoring, policy, thresholds, the action layer, allow step up, deny, monitor. But the part that no one wants to hear, the failure lies in the decision layer. The moment we mistake one convincing snapshot for a durable pattern. So let's trace this through an actual login device. Signal layer, correct password, new new device, VPN exit node from a country the user has never logged in from before. Decision layer, policy says two of the three signals alone are fine, but all three together crosses the threshold. Action layer. Instead of an outright deny, the system asks for a second factor. That's the system working. Now replace new device with agent acting through a delegated token. Much of the same logic doesn't exist yet in that scenario for most environments. The signal layer gone upgrade. The decision layer is still a decade behind. Which brings me to a whole new kind of actor in your environment, one with no self at all. For every nonhuman identity in your org, you've got somewhere between 45 and a 145 nonhuman ones. One in 12 has no owner, half of which, haven't been rotated in over a year, and two in three breaches use one of them. This isn't coming. It's already your state. You just may not have met it yet. It's hiding in plain sight. Service and sync accounts straddling on prem AD and Intra. App registrations, sitting on secrets that never rotate. Delegation change, tokens your automation quietly rides on every day now point an autonomous agent at that. It authenticates through the exact same plumbing and inherits every gap you already have. So here's the strange part. An agent has an identity but no self. It's the actions it is allowed to take. There's nothing underneath. No conscious, No hesitation. No, this feels off. It multiplies like nothing you've ever seen before. One agent can carry 15 to 20 identities and it spawns sub agents, it spawns sub agents, it spawns sub agents. Turtles all the way down, and every turtle has credentials. It acts on your behalf. So whose identity is it? Yours or its? That's a classic Confused Deputy problem, except now it's running at machine scale and machine speed. Think of an agent as a credential with a brain, and a brain is exactly the part you can talk into betraying you. It doesn't get hacked. It gets persuaded. A well written prompt is just text that claims authority. No voice to recognize. No face to double check. Classic setup. A program has more privilege than the user calling it. It gets tricked into misusing that privilege on the user's behalf. We mostly solve that for compilers. We have not solved it for a system that can read your email, book your travel, touch your CRM, and does whatever the last convincing sit in service told to do. Which brings us to the question itself that has to change. The old question, are you who you say you are? Has to change to should this action happen at all. You already know as a mom of three boys. It's it's why I ask consistently. Right? My son's in the kitchen. I don't have to identify that as him. I I already know that part. It's easy. But what I'm constantly asking is, should this action happen at all? Is he standing? Is he holding that thing too close to his brother thou and good? Probably not. With boys, the identity was never the risk, the action always was. But enough diagnosis. Here's what you can actually change Monday morning. Four moves, signals, map what's now cheats to fake, faces, documents, voice, behavior, stop shooting as proof. Decisions, put friction only where the action has real blast radius. Detection, build ITDR, make identity observable, then detect and contain it fast. Governance, only AI that touches identity because someone has to be accountable when the confidence model is wrong. Also, you're not defenseless. Chase these. None of these protocols restore certainty, but they will buy you confidence. Spiffy, secure production identity framework for everyone for one. It gives every workload, every service a cryptographic identity that isn't a shared secret sitting in a config file waiting to be leaked. Continuous access evaluation protocol. Let one system tell another in real time this session just went bad. Kill it everywhere right now instead of waiting for a token to expire eight hours later. Neither of these are exotic. Both are things you can go implement starting Monday. That's the honest reframe. We can't restore certainty. That ship has sailed and it's not coming back. What we can do is design for confidence. So here are the three things I promised you at the beginning of this talk. Your identity stack wasn't built for this moment. The attacker attacker doesn't need your password anymore, and we are asking the wrong question. Identity follows action. It always has. The only thing that change is that action can now be copied, replicated, manufactured, which means confidence isn't something you inherit from a login. It's something you manage on purpose continuously. So back to the question from the party. Is this the end of authenticity? I don't think so. It's not the ending. It's simply a redesign. Authenticity was always a probability. We just got much better opponents. Same game, the architecture has to level up, which leads us to the question, not argue real, that's when retired. The question now is, what will we allow? Their identity was never really theirs to protect. It's ours. Ours to design, ours to verify, and sometimes ours refuse. Identity follows action and so does leadership. So my question back to all of you is this, where do you need to lean next? Signals, scale, or governance? Thank you.