Welcome to HIP Conf 26!

Alright. How you all doing? Well, first of all, welcome to Nashville. Very exciting to have you all here, And I think this is one of those conferences where just by attending, you already become hip, stick a dish, which is by itself a big plus from where I think about it. I'm very excited about everything that we will experience during the next couple of days. We have a lot of great sessions planned, we have some of the most interesting speakers that I can think of, talking about some of the most interesting topics that I can think of. So a lot of excitement coming up. This is obviously in addition to all the parties that are coming up as well. I thought to start by pointing out the fact that we have about 500 identity experts. I don't know if all of them are in the room here, but we have about 500 people attending the conference that represents about two fifty different companies. And I think what's interesting here is is that 60% of those are new to the conference, which is very exciting, but it also got me to think that it might make sense to give you all some background about how the conference started and what it is all about. This is the first HIP Conference. This is back in 2017. I used to have hair. So, just to give you a quick background of why and how HIP came to be. Back in 2016, I was looking to attend a conference, an identity focused conference. And as many of the other organizations at the same, at the time, I was mainly focused on hybrid identity. Meaning, having something in the on prem, being AD, but then also having at least one cloud IDP or more. To my surprise, there were only two options. Either you went to a cloud only conference, either you went to a conference that had a focus on on prem, but then identity was kind of a side thing, Not really at the center of it. And it was a bit disappointing. So at first, I reached to some of the identity thought leaders that I now call friends, and I kind of started asking, hey, am I missing something? Is there a conference out there that focus on the hybrid scenario, and I just can't find one, or what's going on? And nobody can point me out to a conference of that. So my next question to them was, well, if we were to put one, would you come and speak? And luckily for me, they said yes. And that's basically how HIP came to be. I remember having conversations with some of them at the beginning, They told me, like, you know, getting me ready, when we have the first conference, if you have up to 20 people showing up, don't be disappointed. It's still a great success. We will have pizza, we'll have some beers, we'll be fine. It was fine. And yes, we had more people showing up. The other thing that I think that also changed by 2017, when the conference actually took place, and that can also explain why we had more than a 100 people showing up, even to the first conference, was the fact that identity moved away from being this thing, you know, in the basement. That nobody really knows where does it belong. Is this part of IT operations? Is it part of security? Should anyone even care about it? I mean, AD is up and running. Why do we even need to bother? You know what happened in 2016, or towards the end of 2016 and in 2017? Wanna cry and not bet you. And I think that changed a lot in terms of how the industry looks at identity. And identity definitely became part of the cyber defense of many organizations. So all of a sudden, being an identity became cool, which is kind of like "hip." With that, from the early days of the hip conference, we had a very strong sense of community. And I think till this day, this is one of the things that I'm most excited about. Seeing how this community comes together every time that we put one of those events, and even more so, what happens outside of the conference itself. Because it's also been expanding over time. Even now, you know, I was sitting at the back and we saw so many people coming to each other and saying, hey, great to see you, and I know that they have not seen each other since the last HIP conference. So to me, that by itself is a very exciting thing to see, how this community is coming together. And over the years, we started to expand what you can actually have as part of the Heap community, and how can you engage with us and with one another, I should probably say, even more than anything else. So if you have not have listened to the podcast yet, Sean is doing an amazing job there, interviewing a lot of different people on a lot of different topics. Highly recommended the HIP Podcast. Just look it up at your whatever favorite podcast app that you use. We have a lot of things that happening in different annual communities, oh, sorry, regional communities, that is also very exciting. Where we have people that just kind of coming together under this umbrella of HIP to put a specific smaller identity related gathering in where they are. So a lot of different ways to get engaged. Since 60% of you are new, then that means that you have not heard the talks from previous years. And I'll bet with you that many of those are still relevant to today. So if you go to the hipconf website, you actually can see recording from previous years as well, and get educated on some of the topics that, you know, you can't see all at once. Also, since we have so many sessions happening in parallel, I'm sure that, at least for me when I look at the agenda, every time there's like three different sessions, I want to go at least to two of them, which unfortunately I can't. So watching it afterwards is the way to go about that. The one thing that I think is very important for me to emphasize is that HIP is much bigger than just the conference. It's not just about the content, it's actually about networking. It was always the case. I can tell you from firsthand experience that I'm aware of multiple people here that had the ability to exchange ideas with their peers in other organizations, had the opportunity to hear how somebody else have solved the problem that they are currently dealing with, which is always interesting to hear. One of the interesting side effects is hiring. So we saw multiple scenarios where people that met at the HIP conference actually end up either extending an offer to somebody that they've met here, either being hired by somebody that they've met here, which to me is always an exciting side effect of the conference, and I'm personally very much for it. So make sure that you network, make sure that you meet at least one person that you have not met before coming to HIP. Make sure to party as hard as you can at the parties that will be tonight as well. And generally, you know, just have a lot of fun, because this is part of what this is all about. Switching gears a bit. For this talk, my marketing team asked me to come up with several provocative questions or observations, kind of like what I did in 2017. And the first question that they had for me was, will agent replace us? My answer is at some point, but not right now. The second question was, what is the mainstream missing? And for that one, I actually have several bullets that I will share with you. And for each one of those, I will actually also share what I think is my recommendation, and take it for what it is. So the first one, and remember, this is all supposed to be the unpopular opinion. Meaning it's not things that, by default, everybody would agree with. So my first one is AD is alive and well, and it is thriving. Yes. Now, the reason that I even need to point it out is because for at least ten years now, we've been told time and time again how AD is dead. AD will not be here. I mean, first time more than ten years ago, Microsoft even had this statement that it's five years stop until everybody will get off AD. Well AD is very mature. I mean, it's been around for more than 25 years now. But I personally think it's actually a big advantage. AD have a lot of different use cases that you just cannot find in other IDPs. I think the fact that you can, you know, restore an object and have it work as restored is a huge plus. And if you don't know why I'm saying it, see me after the talk, will tell you some horror stories. The fact that you can harden it, the fact that you can, you know, manage servers with it, the fact that you can manage printers. So many different things that I know that all of you know about, but we kind of keep forgetting that by saying AD is dead. Well, my first statement, AD is not dead. The second thing on the same topic is that, obviously, cloud IDPs have a lot of advantages that they bring as well. So it's not that I want to ignore them. I actually think that hybrid is still the most common scenario, and the most useful scenario for most organizations. With that said, it does come with a lot of security concerns. So don't get me wrong, I'm not ignoring that fact as well. All I'm saying is that you should secure it, monitor it, and you should be able to practice and recover it. And generally speaking, you should, and this has been right for several years now, but become even more critical now, you should operate with the assumption of assume breach state. Meaning always assume that you've been compromised, because, hey, haven't said AI, and it's been more than seven minutes, I think. But in the age of AI, here we go, it's obviously that there will be CVs coming out faster than we ever seen before. I think the latest estimation is that by the time that the CV will be published, most likely it's already being abused on the wild. So by default, you should assume and operate under this assumption that you'll be constantly compromised. And let's figure out how do we operate under that assumption, and I will touch upon it on the next slide as well. So the second unpopular opinion is that I actually think that the near term AI risk is from the internal agents that we have in organizations, and not as you might get a feeling if you follow the marketing machine, that it's all about the AI attacks from the external bad actors coming after us. I would actually argue that as most organizations are to deploy AI into their environments, for a good reason, they're doing it because obviously there is a lot of advantages that you get. You get a lot of productivity gains by deploying AI. I mean, Semperis, we adopted AI all over the company. But if you deploy AI without really thinking about what are the security guardrails that that should have in the organization, and how to think about those, you're creating a much more dangerous situation for your organization, as opposed to what I think the external attack surface potentially, or the external attacker, I'm sorry, would do using AI against you. All this to say, yes, do adopt AI. I'm obviously very much pro it. With that said, make sure that you set policies that define clear boundaries for what agents can do, who can access agents, what happens when an agent's being compromised, be it because of the human that controls the agent that is being compromised, or be it because of the agent itself have been compromised. And by the way, some of the things that we've already seen, agents doesn't have to be compromised in order for them to go and cause damage to the organization. I'm sure that all of you have seen the Hugging Face story, where the agent was not compromised, it was not doing anything malicious from the agent point of view, but very much malicious from the actual effect that what happened when the agent was able to compromise, or had several agents come together to compromise an environment. So all this to say that, from my point of view, right now, the bigger risk your organization have, and where the identity experts can actually help, is making sure that the agents that you already have inside of your organizations are being managed, secured, and clearly defined boundaries on what and how that should happen in the organization. And then obviously, monitoring the behavior and having the ability to take immediate action when something goes really sideways. And I'm not saying if, I'm saying when, because it will. Third and last unpopular opinion. You know, I keep hearing about machine speed attacks and how everything is much faster, and I think to some degree we're kind of missing the mark of what it actually means. I don't think the way it is that I read it initially, it's not that the attacks now are faster. That is not necessarily the case, because I would argue that, you know, well defined script that is deploying ransomware in the environment in a matter of minutes is at the machine speed. So what changed here is not how fast the attacks are actually happening, it's what agents can do, because they don't need to take a break, they don't need to stop, they can do multiple things all at once, and I think the most interesting thing, from my point of view, is that they will keep going until they achieve their goal. Which that I think is actually what changed. So it's not necessarily about how fast the attack is going to take place, it's more about how the attack is changing and what is it going to look like. And my main message there is that machine speed attacks can still be stoppable. The three things that I recommend here, make sure that you close as many attack paths as possible, and reduce the attack surface, which, in other terms, is kind of suggesting go back to the basics, right? The things that we already knew that we needed to know, to do as identity security experts, just kinda becoming more critical to do now. The other thing is, again, practice this ability to contain and take action when something happens. And I will also suggest that have humans next to the loop, not necessarily in the loop, because in some cases, you want the systems to take actions on your behalf. Which brings me to the next point, where there is a bright side. Agents can actually be very helpful to us as the defenders and as the identity experts as well, cause we now can have an army of, you know, agents running around that we can delegate the tasks to. And if you haven't seen the demo that ADX does, when he shows basically what his vision for the future is, where he have multiple deputies, he calls those, running around and doing a lot of, you know, kind of minions. Doing a lot of different things and different tasks for him, that's where I think things are going as well. So it's not all bad. There is a lot of good things happening as well. We so much enjoyed HP Europe last year that we are recreating HIP Europe this year as well. Yay. So since this is about 6 months apart, by the way, it's different topics. Sometimes people ask me. In most cases, it's not the same speakers. The topics themselves change, and not just because the location is changing, but also because of how fast the industry is changing now. So we're coming back to Frankfurt in February 2027. The other thing, that was supposed to be drum roll. But we are coming to the next city, and this time it's going to be in Phoenix. We're expanding to the West. You know, every time we try to figure out what should be the next location, where haven't we been, what would be more exciting and more interesting. And I've seen some of the plans that the team have put together for the next event, and it's going to be awesome. It's a whole campus experience. You'll see. I'll finish by thanking our sponsors, because they are basically the ones that helping us to make this whole thing happen. And I will leave you with three things. Gain as much knowledge as possible, network with your human peers, because you can. At some point, you will need to network with your non human peers. That will be interesting. And then, obviously, the most important thing, take practical ideas back to your organization. Thank you.