Rethinking PAM in the Age of AI, Non-Human Identities, and Digital Sovereignty

Welcome everyone to our KuppingerCole Analysts webinar on Rethinking PAM, Privileged Access Management in the Age of AI, Non-Human Identities, and Digital Sovereignty. This webinar is supported by WALLIX and speakers today are Vera de Chauvigny, Senior Market Intelligence Lead at WALLIX. She guides through the fireside chats Guido Kraft, who is field CISO at WALLIX, and me Martin Kuppinger. I'm a distinguished analyst at KuppingerCole Analysts.

Basically, it will be a conversation where Guido and me will discuss these aspects and basically share our thoughts on a variety of topics. A little bit of housekeeping before I hand over. We are controlling audio, nothing to do from your end. We don't run polls today. It's not exactly true what is on the slide, but we had two polls running ahead of the webinar and we will share results of these polls. You can enter questions at any time into the questions area at the lower right edge of the screen. It will find a section questions and there you can enter your questions.

We'll pick the questions at the end of the webinar. Sometimes we may decide on picking a question earlier if it fits very well into the flow. Last but not least, we are recording the webinar and make the recording and the presentation available right after the webinar. Without further ado, let me look at or bring up the agenda, the topics we'd like to look at, and hand over to Vera.

Vera, it's your turn. Hi, Martin.

Hi, Guido. Hello, everybody. Thank you very much for being here with us and a big thank you to Copenhagen for inviting us. We're very honoured and delighted to be here. Lots of exciting topics. We'll talk about today's situation in the market, have a bit of a deeper dive into non-human identities and then another deep dive into artificial intelligence and how that's impacting the market.

Then we'll look at something very interesting and that's digital sovereignty, which is a driving decision factor for a lot of buyers and we'll see how that's impacting PAM and the wider identity and access management market. And then we'll see what's actually coming next and hopefully Martin will give us some predictions and of course a Q&A session, but you're also welcome to ask your questions at any time. So let's get started. Let's talk about today's situation.

If Martin, you can jump to the next slide. Well, PAM, I guess if you're here on this webinar with us, you're probably familiar with the technology. It's for nearly two decades now, PAM has focused on protecting privileged accounts, but something new is happening today. The market is expanding beyond just simple administrators to encompass a lot more constituencies, as we call them, their machine identities, AI and all sorts of other workloads and broader security items. So maybe Martin, you can tell us a little bit more how that's driving the market.

So when we think about PAM in many cases, this is really more about admins and it's about functional or technical accounts. This is the traditional perspective we have here. What has changed already is that we observed that there are specific types of service accounts, like the ones we are using on cloud services to access cloud resources, which have a different characteristic, way more volatile, huge amount of entitlements assigned. And at the end of the day, as I said, permanently changing.

We started addressing this a couple of years ago with an approach that at that time was called Cloud Infrastructure Entitlement Management. Now it is mostly converging into other solutions, but then the entire, what is called non-human identity, better probably called workload identity, some call it machine identity discussion came up. So all the secrets, all the accounts, identities, secrets, it can be different things. A bit of a terminology mix here and frequently not very well probably used terminologies.

But at the end of the day, a lot of people say this are 40 to 80 times the number of humans we are looking at. API keys and a lot of other types of stuff that is used by applications that is related to access. So privileged access coming into play, sometimes not so privileged, sometimes very privileged. Adding to the equation, last of least, there's AI, a topic we will discuss more in detail later on. But with that, we also ended up with agent identities.

And I think we should best perceive everything that is an agent that has an identity that wants access as being highly privileged or at least highly dangerous. And then we should treat it like something that is highly privileged.

Yeah, I mean, I remember Martin, one of the analysts was talking about non-machine identities to talk about humans now, because now we're really, you know, the NHI, I know the term is a bit of a paradox sometimes. And maybe, you know, we have a bit of a love-hate relationship with it because it maybe encompasses too many things.

But, you know, humans are clearly outnumbered. We're talking, you know, one for 80, 400, I mean, different statistics are given. But what it does mean is that PAM, as we know it, is no longer there, right?

No, it is still there. It is just changing. So it is not that the PAM we started with a long time ago, it's not needed anymore, that it will disappear. But it's changing, it's expanding. I think we should look at it from that perspective. It's not that it just goes away and we do something different because that would mean we leave this huge field still of service accounts, functional accounts, admin access, all that stuff, business privileged access open. We need to expand our definition and think broader.

So how is that then the evolving market, the landscape, is impacting customers' priorities? What are they looking for when selecting a PAM? And maybe if you have any specificities related to different types of customers, you can precise what they're looking for and how to choose a PAM in this ever-changing market.

Yeah, you know, there might be still a bit of a gap between how do they choose and how should they choose. And so we see a trend towards a broader perspective. So the workload identity seems, and forgive me not using NHI when I can avoid it, I have no love, a lot of hate relationship because I just think that the term is wrong. So obviously customers are starting looking at other areas, but there's still also a lot of gaps in traditional PAM and there's still a lot of typical purchasing behavior.

So I just can recommend everyone to go for a broader definition, a very broad definition of the term privileged access, both from an identity perspective and types of access perspective. As I said, there's also the business privileged access someone has when accessing financial applications or others. Start broad and then you still can nail it down and say, okay, these are my priority capabilities. These are the first things to do, but I understand there might be more in the future so that I also can build a proper roadmap and strategy all around it.

Okay, so we established that PAM remains critical security control, but buyers are also looking at it as part of a broader identity security strategy with, you know, what's also called the identity fabric. I think, you know, you were the first to coin that term initially and therefore, you know, you need more capabilities and broad identity ecosystem today, but there's one other really important driver and that's regulations.

So I would like Guido maybe to tell us a bit more how regulations are also impacting what customers are looking for or what they should be looking for and how that's impacting the overall PAM market. Guido, go to you.

Yeah, hello all together. Yeah, you see the upcoming regulations or currently established regulations like the NIST 2, the Digital Operations Resilience Act, the DORA in the market of banking and finance, and also the Cyber Resilience Act that are typically the we are now discussing.

And these, I would say, new kind of regulations has a big impact on that market because it changed the way as we worked in that way in the past. So in the past, there are a lot of check boxes making and so, and this is more a shift that we now having that pushes from a discretionary security investment into mandatory operational baseline. So compliance at the end is driving a specific shift from static password walls, as an example, towards dynamic continuous access.

So an overlook of the whole process that is done inside the internal network and mandating things like zero standing privileges, just-in-time access, tempo-proof session recording, things that were not there in the past and were definitely described in another way. So there is not only an evolution of the PAM market itself and not only an evolution of the products and the solutions. The regulations are evolving, I would say, the same time with that.

So take a look at the whole process like secure maintenance, secure remote access, just as an example to say, okay, there is a need to secure this process from the perimeter part where you step in to a PAM system, like with multi-factor authentication and so on up to the end point to have a real secure chain on the whole process. And in that way, I would say there is an influencing on the solutions, on the solution side, on the regulations and on the other hand, an influence on the regulations on the solution development.

So it's a continuous process that goes more and more together as in the past. In the past it was, oh, I have to fulfill this and that, make a checkbox here and that is quite changing.

Great, thank you. So, I mean, what we're seeing is that basically organizations are going from just using best practices to actually, you know, implementing demonstrable controls for disability and traceability, which obviously are the key characteristic of a PAM. Maybe we can go to the next slide, Martin, and see what we did this poll with our base and here are the results we got to the question, what is the biggest priority for your organization today?

So I can see here, as hopefully you can too, that NHI, so the term that Martin is not particularly fond of, but most people recognize still, comes at the top of the list. One thing we didn't talk about, and maybe I'll mention a couple of words, is this IT-OT convergent, which came up second.

Well, I think we all know that this is also hot on the agenda for a lot of buyers, because previously OT remained, so industrial environment, quite isolated without any access to the internet, and now this is less and less true, so sometimes you have to have maintainers connecting, so third party, and that actually can cause a lot of problems.

Let me give an example, just yesterday, you might have read, especially those in France, there was a huge cyber attack on retail stores, big retail stores, where connected systems, refrigerators, were hacked, and the temperature went from its normal freezing or cold temperature to, I think it went up to whatever, 50 degrees, so basically all food was destroyed, lots of damage, billions or millions at least of euros, that's going to cost these companies, and simply by accessing these systems, which are, for most parts, may have been thought to be secure and independent, so yes, striking example, which gives this perfect illustration of why IT convergence is important.

Just in time, of course, is also important, that goes to explain that standing privileges, like we had in the past, where a privileged user has access and is controlled, that's no longer possible, what we want to have is just in time, so only ephemeral accounts, and they can only access for a particular time, and be controlled, and also privileges revoked when the work is finished, so this perfectly illustrates what we've said earlier, and maybe now we're going to go and dive into the top subject of matter, which we just saw, non-human identities, so fastest growing population, as the poll just explained, but also as Martin mentioned, we have 82 to 1 NHIs as to humans, so maybe you can give us a few more words, and explain a bit more as to how different use cases, and how it's actually driving adoption within the pump market.

So I think we all understand there's a challenge in highly privileged access, so basically the stuff we did with traditional functional accounts is happening now in a much less controlled manner, so we had this account we used to access a database, or whatever, a technical functional account, and right now these are dozens, hundreds of different smaller accounts, some of them highly privileged, I believe our biggest challenge, obviously, here is it's not only the identity people who can handle it, or the privileged access management people, I still see organizations where privileged access management teams are not really part of the broader identity management team, which is just wrong, so it's part of it, it must be in the same organization, but the workloads, they come from application development, from DevOps, from this agile environment where things change quickly, change a lot, so we need to cross, so to speak, a border, or a boundary, and work with other teams to make this work, and this is obviously a challenge, I think the entire market also is driven by, right now, the need to first discover all these identities, before we can bring them under control, that is what also drives the adoption, a side of control about walls, I think adoption is obviously driven right now by the need for discovery, because we can't secure, we can't manage what we don't know.

Martin, we've just actually got a question in the chat about both NHI and ITOT, so the question is, searching for NHI in both ITOT, which are the best practices do you recommend through the network, so maybe, you know, once they've been discovered, you know, what are the next key steps?

Yeah, so discovering rarely works when it happens only at one place, so we have, when we take, so we need to be a bit more careful when it comes to OT, depending on what we are looking for, because at the OT level, we need to be way more cautious and conscious about resource consumption on the devices, that might be an issue there much more, but at the end of the day, what do we have?

We have a network, we have walls, like whatever, HashiCorp wall, and other walls, we have the development environment, so we have quite a number of places where we can look at these types of identities, sometimes it's just secrets, and discovery should be multifaceted, so you can't restrict it to just one single place, where you look and hope that everything passes by, also because some of the stuff happens in the cloud, it will not have that much impact on your local network, maybe, so it's really, I think the bigger the variety in discovery, the better it is.

Right, and actually we have another question, obviously this topic is of interest to many, non-human identities now outnumber humans many times over, in the programs you've seen, who actually owns them, so perfectly fitted with our next subheading, budget and ownership, so who owns them, is it PAM, IAM, the platform team or app owners, where does that ownership break down, so when managing non-human identities, which team owns them and where does it break down?

I think there are two types of ownership, the one is who owns the secrets, the workload identities, etc, the other is who owns the topic, and we need to differentiate, where we are still mostly weak is in ownership handling of different types of workload identities, that is something where we need a lot of automation to assign ownership, and we may even have multiple levels of ownership, the developer for certain components, the application owner for across these components, and others from a program ownership, we see that the security aspect, so this management of these identities and secrets is at least in the CISO domain commonly, but with the need to work closely with the developer teams, and I personally believe this also requires a fundamental shift in the way we do identity, because we are a bit used to say, okay we do this IGA program to take another discipline, and in five years from now we are done, which is an adjacent technology to PAM of course, and developers won't wait for that time, they need it now to continue doing the job, so we need to move to a service thinking, to deliver the service when it's needed, to plan ahead, and to deliver at the speed of business, so that we can deliver the service, and own the service, while the developer side are the consumers, and believe me, developers don't want to set up walls, they want to develop, security is not what they want to do, they will hand it over if the service is good.

And actually another question, very direct, is who is actually accountable for NHIs?

So Guido, maybe you can tell us about regulations, and how you know NHIs are actually accountable, and where they stand, because obviously being quite new, regulations as you were saying, it's a chicken and egg, regulations have to follow, and yet regulations also drive the development of products, so where do regulations stand, who is held responsible for NHIs, and maybe that will put some light into that question that somebody's asked, so maybe we can go to next slide, and Guido can explain NHIs, and you know, in the light of compliance and responsibility.

Yeah, coming back to the question before, responsibility, that this depends anytime on the section where we are speaking about, and the two main fields we speak about before, are here IT and OT, it is very different in the OT section, also then you have additional, what Martin mentioned, the people who are doing development in the way of the OT section, that is a speciality on speciality, I would say, and so you have several standpoints where you can take a look on it, who has the responsibility on that, but we said also, there is now, some numbers are saying we have an outnumbering from 45 to 1, in the meantime it is set 80 to 1 on NHIs to human things, and the regulators for sure, and auditors have realized that governing humans while ignoring service accounts, API keys, AI agents, creates a massive compliance blind spot, and so at the end, again, more or less new regulations like Digital Operations Resilience Act, like NIST 2, already mandate end-to-end access traceability, that means at the end, unmonitored service account, hard-coded secrets, are increasingly flagged as a direct failure of operational resilience, and it is, and coming back to the poll that we had, and that is a good news at the end, that 42% are saying, yeah, we need to search for these NHIs, because I can only secure what I know that I really have, and that is exactly the question the auditor will ask at the end, what is your current situation, and if you then deliver your active directory and say, yes, my accounts here, you can check that, and how they are flagged, and so on, that is nothing an auditor in the year 2026 or 2027 will count on, because this situation is continuously evolving, it changes from one second to the next, and if sometimes an auditor is on organization, and the second he leaves, in the second he leaves the room, the situation has changed at all, so there is a continuous overview of that, again, we speak about like numbers 45 to 1, and then new numbers 80 to 1, I believe beginning of next year, we are speaking of 120 to 1, and then additional, we will come later on that, there are also then the AI agents on that, and their identities, what quite is different, it is also a non-human identity, but again, quite different, but on compliance view, they have it really on their mind, especially when you take a look at the Cyber Resilience Act, and again, we're coming to that, I stated at the beginning, reviewing processes, and in the meantime, you have several business processes, where you have at the end, I would say 5, 6, 7 NHIs, who are working on that process, or sometimes more, when you go to the OT part, you have more, and then this is obviously clear, because agents are executing things on our behalf, so they must absolutely be traced, just like humans used to be, so this is the natural extension, and auditors are looking at it the same way, well, actually, if you don't mind, we're going to go to the next topic, just bringing one thought, and I like this question, who is actually accountable for NHIs, so we have this accountability versus responsibility, and there could be one who is accountable, and I think this is a very astute question, because you need to bring it up, you need to make a decision, is it a CISO, or is it the lead of the entire application development, groups, teams, whatever, and depending on that, the way you handle it, where the budget comes from, where the budget must flow, will fundamentally change, there's not a simple answer, but it makes me think, and I think it's very worth to keep that in mind, because it's a, as I said, it's a very important thing to do, and I would dare to say that most organizations haven't properly solved the accountability questions, that you should bring it up.

Yeah, because you can't take an agent, or an application to court, or fine it, so obviously, it needs to be traced back to a human, and this is a big question, and I guess it's going to be still on the agenda of many CISOs, and probably compliance leaders for years to come, and actually, the next topic perfectly fits within it, because it's the driving force, so this explosion within NHIs, that's artificial intelligence, all the agents, once again, working on our behalf, doing things, and then agents of agents, and the whole network of agents, which is now, has invaded pretty much every workspace, so this as well, is changing the PAM conversation, and it's moving from just a tool, that's provide recommendations, to actually autonomous agents, capable of taking actions, accessing systems, making decisions, making templates, I mean, we will know it, we probably, you will have examples to give, based on your type of business, so let's go now, really deeper into this artificial intelligence, and the agents, that are behind the whole NHI revolution, what can you tell us about that, Martin?

Oh, how much time do we have? Yeah, okay, 10 minutes, this is the biggest topic, I know.

Yeah, we can spend an hour, I think, there are a couple of things to look at, the first is, again, how is AI changing the way, we think about identity and access, we should also ask the question, how should it change the way, so I still see a lot of oversimplification here, starting with, just using the term NHI, for whatever an API key, at the same level, as an autonomously acting agent, that have been built by another agent, these are very, very we must not treat them the same, it is, agents are, depending on whether they are managed, restricted agents, or broader agents, that have less control, they can be very autonomous, they're probably, in some way, from an identity access perspective, closer to a human, than to most of the workload identities, what I believe is, what we must understand, is that there are tectonic shifts, we are facing, and the point is, in the past, or so in traditional environments, we, for instance, say, whatever, Guido has an account at SAP, at the SAP system, he has certain entitlements, that then translate from SAP business roles, down to SAP T codes, this is a, and then Guido accesses SAP, this is a directed access, with deterministic entitlements, the problem, nowadays, is we have, we do something, that triggers an agent, we may not even know it, that triggers other agents, that build, that end up somewhere, and your, whatever MCP server, which is, currently, the most logical, but not, over time, the best place, to make authorizations, your MCPs, or only authorizations, your MCP server has no clue, which agent will knock on the door, in the next minute, and why, whether this is legitimate, or anything, so, our identity access changes from a static, and we know, who will access what, to, there are access requests, and we need to, first, need to figure out, whether they are legitimate, or not, in that sense, we should treat all of that, as highly privileged, because this is the logical starting point.

Yeah, yeah, and yeah, so, AI, bringing in a lot of, you know, complexity, into, for BAM, because we need to cover these additional agents, but also, it's bringing additional value, because there's also AI, for BAM, or you know, for IAM, in general, so, while we tend to focus mainly on conversations, on the, you know, the problems, and issues, let's maybe look at the opportunity, that's, that lies ahead, with the rise of AI, how can I improve access decision, also, maybe reduce operational overheads, you know, provide conceptual behavior analysis, you know, any other examples, you can give, that, you know, you expect BAM vendors to, you know, to leverage, in the coming years, in order to make administrators jobs easier, or just generally enhance the security outcome of any BAM solution.

Yeah, let's talk coming months, instead of coming years. Sure. What we see, obviously, are resource assistants, the agents, that help someone.

I believe, this must become more, more intuitive, so, more understanding the context, and then bringing recommendations, without someone asking, but that's one thing. We see, obviously, playbooks to handle more complex situations, but a logical area, for me, would be all this session, monitoring session, analytics area, where agents can do the job for you, and then hint you on the very, very few things, you may need to pay attention on.

So, that can reduce a lot of workload, and increase the practical usage of that, but also, take application onboarding. It's so much easier to, with AI, to onboard applications, to understand the specificities of a certain target system, to do the code, etc. All these things are areas, where we see already an increasing AI value.

So, it's obviously, this guidance thing, so, where your assistant comes up to a more intuitive guidance, to complex playbooks, everything. AI helps us in doing a lot of things, much faster, much more efficient, and so, basically, really augment the PAM administrators and operators.

Yeah, we have a lot of questions on this topic, so, I'm not sure we'll get through all of them, but I'll reach another one. How do we integrate AI and agentic AI into the PAM life cycle? Which part of the life cycle will, will 100% account on AI and agentic AI, or which part will still need the human in the loop?

So, how do you see that evolution? I mean, do you really see autonomous PAM?

You know, it depends a bit on the area. So, if you have a rather autonomous OT operations, then there might be quite a bit of it.

I think, when we look at all the automatically created identities, be AI, be it workload, whatever, we need automation here, and that's where also AI comes into place in observing and making decisions. For a human in the loop, I prefer the term human on the loop.

So, human in the loop sounds a bit like... Like a threat. Yeah. Human on the loop means the human comes in when there's an anomaly, when there's an exception, and humans are far too slow for what is going on in AI and workload identities. We can't cope with the speed of it and the scalability, the scale of it.

So, we need to bring in humans only when it's needed. So, I think we can use it everywhere to automate. We need to understand where are the things where we need to spot anomalies, and I think we also need to understand do we sometimes need more than one AI, one LLM, the one basically being the observer of the other that can make a lot of sense.

So, basically, the four eye-prints of Olympic quotas of the AIs. I think, if you don't mind me jumping in, I think what needs to happen is that PEM vendors like Wallix, but many others out there, and very respectful vendors, we all collectively need to provide solutions which respond to particular use cases, and use cases can be very varied and very different.

Here today, we're talking with R&D and about different environments that we see in manufacturing, for example, which is so different, this OT space to IT, because, for example, they sometimes need to validate things on their, not on the laptop, but they either on the phone or on the tablet, and they can have gloves, for example. So, it's very different. They can't do the same validation as those in IT who are sitting in front of the computer and can type things in.

So, it's all about being adaptive and providing what customer needs based on the environment, based on different use cases, different sectors, different environments, whether it's IT or OT, which are still, despite this convergence that we're seeing, are yet still very different and need to have different responses from the vendors. But we do have to move on, otherwise we're not going to cover everything.

So, I have a next thing we'd like to talk to Guido about, this continuous compliance, because obviously, you know, compliance then we're seeing is shifting from periodic assessment to just continuous readiness. Can you explain a little bit more this concept within the whole, you know, compliance landscape of NIS2 and maybe focus a bit on the CRA, which is obviously the new kid on the block that we also have to learn and still come to terms with? Just one short step back to the question that was there.

I would say there are two different things in the loop when we are speaking about AI, that is in view of PAM, that is on the one hand, and that is related to the continuous overview.

All the things that are directly on-demand session related, so if the session is running and the control over the session and how we can handle that with the help of AI and AI agents in the future, and then the post-session situation, what is more about analytics, that is directly referring to the auditors and so on, taking a look what has happened on the system, what is current situation, what needs to be changed in the future to have a continuous improvement process of this. So, there are the two main, I would say, topics on that, but in general, I would say AI plays a double role.

It is both the ultimate operational enabler and a new subject on the hand of regulatory oversight. So, enablement side, what I said, AI revolutionized auditability, so you have a very huge tool set at the end to take a look what has happened on the system, what is quite happening on the systems, and that refers directly to the move away from this static annual audits, they are obsolete at the end.

So, machine learn algorithms continuously will analyze excess behavior, flag entitlement anomalies, automatically enforce least privilege by recommending, by deprovisioning of unused rights for old accounts that are still there until 20 years, all these things. On the other side, I would say the rise of autonomous AI agents creates a massive new governance surface.

So, these agents perform actions, make decisions, I would say in that case, make decisions and access sensitive data independently, and making AI governance in that way an integral part of the identity and access management. At the end, AI, I would say, transforms compliance from a manual resource intensive burden into a self-healing continuous security process plan, like in the good old plan, do, check, act cycle.

So, at the end, it will bring us in a situation that our solutions and also the PUM and IAM solutions will becoming a part of a continuous improvement process of the security, and that is a very big chance also for us as a vendor to move with our customers to the future, because to say, hey, it is not only a solution, it is a part of your process of becoming better and better and better on the security. So, it's stimulating innovation within the market. We don't want to stop AI agents working independently, because that's what they're there for.

We want them to execute on our behalf and help take some of the workload. I mean, that's what is really happening, but we want to enhance their expectations as well from regulatory perspective, everything around accountability, traceability and governance.

So, you have to work hand in hand in order to be able to exploit and continue exploiting and making benefits of AI, right? We need to absolutely move on to the next topic, otherwise we'll run out of time. So much to say around this, we could talk for hours.

Yeah, absolutely. Yeah, you talked about traceability, accountability and high risk of AI, we're going to move on to the next topic, which is sovereignty. This is a really new concept, but that's being really at the forefront of a lot of vendors. We're seeing this, you know, the whole digital sovereignty moving from sort of a political discussion and boardroom topic to now, you know, a central piece for vendors within identity and access management, but, you know, more broader within cybersecurity as well.

You know, Martin, maybe you can just explain a little bit how this all happens and how is sovereignty become such a hot topic? You know, at the end, it takes long to build trust. It's sometimes only takes seconds to destroy trust. And I think there were a lot of things already in the past where there was some, like the NSA stuff, et cetera, where there was unsecurity, but this has changed, this has increased. And at some point you're crossing the tipping point in a sense and start thinking about which are the areas where you need more independence and higher control.

Obviously, when we look at privileged accesses, high security, cybersecurity stuff, then this is a very logical starting point for a sovereignty discussion, because this is about how you protect the rest of the stuff. Yeah. And of course, security and functional requirements still remain essential, but, you know, it's increasingly organizations are evaluating, you know, operational control, deployment, flexibility, jurisdictions. These are all the items that we see within sovereignty, which is a very broad topic.

And it has, you know, several meanings once again, and very specific meanings within the PAM and just more broader cyber vendors. Are there any particular selection criteria you would pull out to say, you know, are the ones that buyers should consider when, you know, looking and shortlisting maybe solutions? There are two things. The first thing is at the end of the day, it's still about having the capabilities in place you really need.

We all know that most of the RFP questionnaires with all the capabilities are way too long, and look at a lot of capabilities you don't need, but it must focus on what do you really need. And good enough, in that sense, is not good enough. When it comes to sovereignty, the solutions must be competitive and fulfill these requirements.

As I said, it makes a lot of sense to I'd say, I look for every feature, but I look for the features that are relevant to me, that helps in selecting. Then the other thing is that there's not serenity, there are a lot of levels of serenity from I have a specific region in the EU, to I have operations that is handled from within the EU, to all the hardware even is owned by an EU legal entity, and fully EU legal entities is not owned by non-EU entities, and different things in between.

So you need to understand which level of serenity do you need for which use case, then you can make your right decisions and think about what is the best way to proceed. But it's not something you do only because of serenity, I think there's more to consider behind it, starting with understanding there's not serenity as such, but there are different levels.

Exactly, where do you put the cursor, what matters to you, there's also certification bodies within the different legal entities and nation states have their own, like BSI in Germany, like you've got anti-certification, which also adds to the sovereignty influence for a vendor, so I think that's very interesting to look at, which level, what matters to you, where do you place your cursor, as you mentioned, how much sovereignty, meaning ownership and freedom to operate, to do your own, and does your vendor provide.

Maybe we can just quickly look at the next slide, which shows the poll that we ran on this subject, oh again next, sorry, and then we'll come back then, yeah there you go.

So yeah, we asked this question to our customer base and yeah, the answer is very clear, the majority think it matters, so either it's a primary decision factor for 41% or secondary, and only for a very small minority of 8.5% it was not a consideration, so yeah, clearly a big decision, a lot is happening in this space, I think vendors are also looking to be more and more independent and create that sovereignty within their own product and their own companies to be able to respond to this criteria, but it's definitely a criteria which is gaining traction.

Maybe come back to the previous slide and Gideon if you want to say a couple of questions on what is, how is it measurable within the whole framework of procurement and compliance and what do you see from the regulators?

So what we see is that there is a dedicated trend, we all know the political and the global situation, geostrategic situation that we have currently and there is absolutely a need, but I would jump directly on the words of Martin who said take a look what you really need and then make a decision in view of sovereignty, because I have a lot of time the situation also in my former work life that there is an overwhelming of solutions also on security solutions that are not under the control of the company anymore and they are asking themselves what is the real thing or what are the real solutions I need to secure, coming back to that, my processes and there we have the situation that in the past the company's jumping on the ideas of zero trust.

Zero trust, very good, I don't want to say anything against zero trust, but at the end companies start with a zero trust project and they end up two, three years later with a zero trust project, because it never ends at the end and exactly to that what Martin say in view of sovereignty, what do you really need, do a new approach, do an approach like a minimum viable zero trust approach, what is that?

A minimal viable zero trust means I focus on a dedicated scope and that scope could be in the view of PAM, secure remote access to my company, secure maintenance to my company, part of this process and then if I know really how the process is built, I can secure this process step by step with one solution portfolio out of in that case IAM and when I take back then a view on the real zero trust approach, the overall real zero trust approach, then you will find out that with managing identities, that with managing access you have done a lot of the way of a global zero trust approach.

I would not say 90 percent, no, but I would say 60 to 65 percent you will have done, because everything refers at the end to access and to privileges and in view of regulations exactly the same, take a look at the regulations, add in this too, add a digital operation resilience act, read it and you will see okay you have to make sure that the access to, the access from and so on and so on, it is I would say all about access.

Yeah, so maybe let's just wrap this topic, we need to move on, but yeah it's influencing not only public sector projects, but also critical infrastructure and your regulated industries within even private, so definitely a growing decision for the buyers.

So very last topic and we'll have to close off after is what's next, so please Martin, Guido, very short, give us your top predictions for what's coming next in this very flexed already market, which is as we've learned is opening up and therefore tending towards identity and access management with different use cases and platformization and AI governance and all the whole operation of resilience and everything else that's happening. So what's going to happen next, your top prediction, please Martin.

So first panel is here to stay, but it will significantly expand, so it will become much broader than we know it from history and I think this is more the evolution than the revolution. There will be other areas, so there are elements of AI security which are not in the domain of privileged access management, but there will be an intersection and it will remain a vital part of broader identity security and concept and it's essential for every identity fabric.

Great, any particular advice for PAM buyers? Think broad, think beyond traditional PAM. I think I brought up a couple of points there already, so understand what you need today, what you will need in the future, but also focus on what you really need to make a focused decision on what you really want and probably also talk with the vendor about the plans around AI for PAM, but only PAM for AI. And now over to Guido, if you could give us the same a few sentences Max about regulatory outlook and your top recommendation to prepare for this.

So the biggest prediction is that I would say compliance regulations will force complete convergence of human machine and AI identity governance into a single real-time control plane. I believe within the next three years regulators will abandon access reviews entirely in favor of dynamic continuous risk validation. Compliance at the end will no longer ask who holds privilege access but rather what entity human service account or autonomous AI agent is taking what action right now and is it justified.

Great, thank you. So a lot's happening, we have to wrap up, this has been absolutely amazing. I love talking to you Martin and Guido. I hope we can do this again, thank you all for your participation. So the two takeaways, think broad, real-time control plane for your solutions, recommendation is to expand your strategy in the context of this identity fabric and you know use composable security to compose your solutions and with the ever-evolving world.

I'm just going to ask a couple of questions because now it's time for Q&A but we have taken a lot of questions during the webinar trying to make them fit to the themes that we're going through. There's one question we have various actually on sort of good enough privileged features from providers like Okta or Microsoft.

With that, does this prove, sorry good enough features like Okta and I have another question from Microsoft. Would this not need to have a traditional PAM? Is this good enough and structurally sufficient specifically for NHIs? Maybe we'll ask Martin as an independent body here.

Yes, I don't want to comment that much on this webinar on other vendors offerings. I think we need to be very careful with good enough and what we need and I think the only recommendation I can give is look the capabilities you need, you really need. Look at it from not just can I pass an audit but can I increase my security. Will I be secure enough in this world and turmoil and which capabilities are needed especially when it comes to the most critical parts of access and that should be your foundation for selecting the appropriate tool.

And as Guido stated a lot of this probably is nowadays from a regulatory perspective yeah depicted by more and more requirements that are raised so we need strong solutions. Yeah, we have another question. How should you handle privileged access for external vendors and OT environments? Maybe I can take that.

Our recommendation is not to provide permanent uncontrolled access to industrial systems, to avoid using VPNs but to have secure remote access with you know named accounts, with controlled workflow and accountability for approvals and ensuring that the privileges and access is closed when if it's a third party or maintainer has finished whatever he needs to do and to be able to close it in due course. So these recommendations that we provide as to you know access to industrial systems. And maybe one last question just came up.

Assuming PAM adoption is a given, where do you see the most critical integration paths and synergies emerging such as with ITDR, SDPM or AI governance? What level of defensive advancement can this cross-domain convergence actually deliver? That's a great question. Some people tend to say in this case it would take long to give a comprehensive answer. I think the the thing you should look at is signal sharing. Signal sharing like in standards like the shared signal framework, like RISC, like CAPE, continuous access evaluation protocol. And I think the integration paths must be very flexible.

So we need to be able to integrate between different types of solutions and to transport the signals. And this is where we have new standards. Look at these standards that will help you coming closer to a good response to this question.

Great, thank you. I think that's all. We've answered the others during the webinar. Just checking.

Great, thank you all for participating. It was a great pleasure to share this floor, Martin and Guido. Thank you. Wonderful and I hope to see you again. If you have any further questions don't hesitate. I'm sure the organizers will follow up and be able to reply to you. Thank you very much.

Thank you, bye.