Continuous Trust and Authorization
Combined Session
Thursday, November 26, 2026 14:40—16:00
Thursday, November 26, 2026 14:40—16:00
Identity Threat Detection and Response is where the market is visibly moving, but most organizations still can't tell the difference between a legitimate access anomaly and an active identity attack in progress. This panel examines what real identity telemetry, attack path management, and automated response look like in practice, and how far detection engineering still has to go before ITDR lives up to its promise.
A forgotten application on a laptop asks the internet for updates, every few minutes, with full system privileges. No user is involved, nothing is signed, and nobody remembers installing it. When our threat hunters spotted it in customer telemetry, it turned out to be running on millions of devices worldwide, including corporate networks.
This talk tells the story of what we found, what an attacker could have done with it, and why stolen credentials, tokens and sessions from such devices are the raw material of modern identity attacks. We share how we weighed the legal and ethical limits of active defense, what we decided and how it turned out. You will leave with practical guidance on software inventory, update hygiene and continuous trust beyond the login.
