Best of LinkedIn: it-sa Expo&Congress 2026

00:00:00: This episode is provided by Thomas Allgaier and Frennus based on the most relevant LinkedIn posts about ITSA Expo in Congress, twenty-twenty six.

00:00:08: Frenness supports ICT enterprises in the form of delivering precise ICT market and pricing intelligence that analysts subscriptions and existing databases cannot provide.

00:00:18: you can find more info in the description.

00:00:20: Welcome to The Deep Dive everyone!

00:00:21: Yeah so imagine finding out that the AI agent...you know..the one summarizing your morning meetings right now actually has more network permissions than your own chief information security officer?

00:00:31: Yeah,

00:00:32: that's a terrifying thought.

00:00:33: But today we're looking at on the ground intelligence from The Floor of the Massive ITSA Expo in Congress, twenty-twenty six.

00:00:40: In Nuremberg exactly

00:00:42: We are bypassing all the PR pitches and Looking directly At what the experts were actually debating On the floor right?

00:00:47: And our mission Today is to cut straight through that trade show noise.

00:00:51: We want to extract a raw strategic shifts happening Right now in digital transformation and tech.

00:00:56: for you the listener

00:00:58: We're talking about how AI has rapidly morphed into this critical identity risk why regulatory compliance is demanding mathematically hard evidence now instead of just, you know PDFs.

00:01:08: And also how digital sovereignty is completely reshaping IT buying decisions across Europe?

00:01:14: Right so.

00:01:16: the overarching reality at ITSA twenty-twenty six was that AI has officially crossed the line.

00:01:22: it's no longer just a cool productivity booster.

00:01:24: its massive quantifiable operational

00:01:27: risk.

00:01:28: Yeah, the central question on the floor wasn't whether you should use AI in your enterprise?

00:01:32: It was well.

00:01:33: how do you keep it from accidentally or maliciously tearing down your infrastructure?

00:01:38: and The scale of this wrist gets pretty obvious when you look at an insight from Dr.. Tobias Libram At cyber desk.

00:01:44: he pointed out that currently less than five percent Of granted permissions and organizations are actually ever used by the human employees who hold them.

00:01:52: wait really Just five percent?

00:01:54: Yeah, I mean most of us just do our specific jobs and ignore the rest of the network.

00:01:58: right but AI agents they can see all those dormant permissions instantly.

00:02:03: Oh wow!

00:02:04: Now think about the mechanics how an AI operates versus a human.

00:02:08: if a human has excess permission They might accidentally stumble into sensitive payroll folder once in decade.

00:02:16: Right

00:02:16: exactly.

00:02:17: But an AI agent by its very nature it crawls ingests and maps everything it has access to, the millisecond it gets provisioned.

00:02:25: So if you give an AI broad access... It knows exactly what data it can touch!

00:02:30: And it acts on it in milliseconds

00:02:32: Which introduces a completely new attack.

00:02:34: vector Goontre Meyer from Blue Flag Security had this fascinating post pointing out that coding agents like various co-pilots developers use are essentially brand new work force for your software factory.

00:02:47: Yeah, so one single human developer now suddenly represents multiple identities all because of the AI agents working alongside them.

00:02:55: Exactly and ninety percent of attacks on the software development lifecycle The SDLC which is basically the assembly line for your code They start at the identity level not the code itself.

00:03:07: Man industry's really having to wake up to the fact that these non-human identities are the primary threat surface.

00:03:13: Now

00:03:13: Yeah, Soren Vujit-Kristiansen noted that entrust is actually actively addressing this.

00:03:18: They're applying multi-factor authentication and the SPIFI framework directly to AI agents.

00:03:24: Wait... MFA for an AI?

00:03:27: How does it even

00:03:27: work?!

00:03:28: Well SPIFIIII!

00:03:29: It's basically a way to give secure, highly restricted digital passport.

00:03:35: So you can no longer just trust an agent because it was deployed on your internal network.

00:03:40: Oh I see You have to continuously authenticate the machine Just like you had prompted human to enter code from their phone

00:03:46: Right exactly And monitor what is does after logs in Gregor Aresman posted about their new launch Agent Guard which designed to detect AI behavior drift and data leakage.

00:03:59: Like an AI might start its morning summarizing marketing notes, but what happens if it suddenly pivots and starts trying to export your customer database?

00:04:07: Exactly.

00:04:09: And Ron from Netscope noted that they are framing this entirely around data access like What exact data can the agent touch and who is ultimately accountable when It makes a mistake?

00:04:20: But wait aren't we just treating The symptom here with all This monitoring?

00:04:24: There was this analogy inspired by Eugene Moeici, the third's post that really highlights.

00:04:29: This

00:04:29: oh The valet key one.

00:04:30: yeah He compared giving an AI agent broad permissions to handing a valet Key.

00:04:35: do it total stranger?

00:04:36: But that keys somehow give them access to every single room in your house not just the car.

00:04:41: That is a perfect way To look at it

00:04:43: right.

00:04:44: and he mapped this back to the evolution of OAuth Which you know with the protocol?

00:04:48: That originally allowed us log into a third-party site using Google or Facebook without Giving them our actual password.

00:04:54: Yeah if we are relying on AI to just sort of behave while it holds the master keys, We're setting ourselves up for failure.

00:05:01: We need strictly scoped revocable access right out-of-the gate.

00:05:05: Trust based good manners simply does not scale.

00:05:09: But I guess governance is finally catching up this right?

00:05:11: It Is yeah.

00:05:13: Norbert MOE shared that Vanta Just won IT security award For their governance risk and compliance work often called JRC, specifically because they are focusing on AI governance.

00:05:24: So when they ARE helping companies build those strict revocable boundaries we just talked about?

00:05:28: Exactly!

00:05:29: And Maximilian Freshener also highlighted Platformation's ServiceNow AI Control Tower.

00:05:35: it is all about integrating that AI governance directly with your security posture

00:05:39: Which gives you a centralized view of exactly which AI systems running who owns them and exactly what the valet key allows him to do.

00:05:46: Right.

00:05:47: And if you want proof of why you need to lock down those identities so strictly, look at the demonstration KPMG put on.

00:05:53: Oh yeah,

00:05:54: Pablo Schmuck posted about this.

00:05:56: they were bringing visitors to their stand recording a short audio clip of their voice and generating a highly convincing deep fake in just sixty seconds.

00:06:05: Sixty seconds?

00:06:07: That is incredibly fast!

00:06:10: Before we dive into the implications of that speed though, just a quick reminder for you listening.

00:06:15: If you want to make sure you catch future editions these deep dives and critical tech trends Make Sure To Hit.

00:06:20: Subscribe!

00:06:21: Definitely.

00:06:22: But yeah imagine an AI agent with broad network permissions getting compromised And The attacker uses A sixty second deepfake Of your CEO To authorize massive data transfer.

00:06:34: When the attack vector moves That fast Human intervention is completely off the table

00:06:39: which is exactly why the regulators are fundamentally changing how they operate.

00:06:44: Because technology's moving autonomously, compliance has no longer about like handing an auditor a PDF claiming your systems are secure.

00:06:53: No, regulators want you to prove it in real time with hard machine readable evidence.

00:06:58: John Bogner shared some pretty sobering details regarding the Cyber Resilience Act, or the CRA.

00:07:04: The reporting windows under this new European legislation run in brutal stages.

00:07:09: Yeah you have a twenty four hour early warning requirement followed by full seventy two-hour notification.

00:07:15: Think about your own security team right now But clock starts taking second to discover vulnerability.

00:07:21: Twenty Four Hours is absolutely nothing.

00:07:24: In the middle of chaotic incident response.

00:07:26: To even have a chance at meeting a twenty-four hour legally binding deadline, your visibility has to be automated.

00:07:32: Right.

00:07:33: Alden Basic from FASA was the event showcasing Software Bill of Materials or SBOM tooling purely help companies keep up with CRA compliance.

00:07:42: Yeah think about an SBOM like the ingredients list on back of a cereal box but for software.

00:07:47: So if a critical vulnerability is suddenly discovered in a tiny piece of open source code, you need to know instantly if your software contains that specific ingredient.

00:07:56: Exactly and the frameworks across the board are getting exponentially more rigorous.

00:08:00: The BSI which is Germany's Federal Cybersecurity Authority just released standard three hundred dash one for Grunschutz

00:08:07: plus, plus.

00:08:08: Oh right Robert Wagner and Andre Prosarov both analyzed this at the event.

00:08:13: it is a completely new process oriented and crucially machine readable standard

00:08:18: meaning compliance shifting from written policies to automated code checks And they noted there's five year transition period with absolutely no parallel operation allowed between old and new standards.

00:08:30: Well let me stop you though because Jan Christof-Soa from High Solutions has a really pointed question on the floor about all this.

00:08:38: Are we just throwing more tools at the problem?

00:08:40: That's a valid question, tool sprawl and alert fatigue are rampant right now.

00:08:44: Yeah, do all these new compliance-driven tools actually solve our underlying resilience problems?

00:08:50: or are they just creating more digital paperwork while the servers are actively being breached?

00:08:55: I mean it is the single biggest pain point for security teams today.

00:08:58: Marcus Fritz from Acronis named MDR Alert Fatigue meaning The Endless Stream of Warnings coming From Managed Detection and Response Services And Tool Spraw as the absolute top concerns.

00:09:09: he heard.

00:09:10: Security analysts are just drowning in alerts.

00:09:14: They really are.

00:09:15: Clients are actively saying they don't want more tools, they want fewer tightly integrated platforms that actually give them visibility without all the deafening noise

00:09:24: And to prove why that integration and speed matter over just having a mountain of tools?

00:09:29: Brian Oaken posted a wild real-time example about Singular.

00:09:32: Oh this was right around the time of the event wasn't it?

00:09:34: Yeah A critical PHP two shell vulnerability was disclosed at fourteen hundred UTC.

00:09:40: For context, a PHP two-shell vulnerability basically allows an attacker to bypass security and execute remote commands directly on your web server.

00:09:49: It's literal worst case scenario.

00:09:51: And how did Singular handle it?

00:09:53: They used their autonomous Security Agents.

00:09:56: The agents mapped the exposure across network Caught the live attacker onto decoy server and contained entire threat in twenty seven minutes.

00:10:04: Wow Yeah.

00:10:04: from global disclosure To full containment without single human querying database.

00:10:09: See that twenty-seven minute containment is the new baseline for survival.

00:10:13: Because if you look at The Human Alternative, it's pretty bleak.

00:10:16: Yeah!

00:10:16: Nerula Demir from SecureStack reported on this.

00:10:19: A full week after that exact same PHP to shell vulnerability was disclosed... thirty point four percent of .DE websites with a visible PHP version were still vulnerable.

00:10:29: A FULL WEEK LATER and nearly a third of those sites were wide open.

00:10:33: Manual upgrades completely stalled out.

00:10:36: Human teams simply couldn't identify their vulnerabilities test the patch and deploy it fast enough.

00:10:41: Which illustrates perfectly why companies are finally realizing the true stakes of incident response.

00:10:46: Jan Schott mentioned that SVA and Cisco were actually running a worst day game at their stand to test actual incident readiness.

00:10:55: That's smart.

00:10:56: It forces organizations to realize that resilience isn't a compliance checklist, its how your systems actually perform on.

00:11:05: But, you know catching an attacker in twenty-seven minutes doesn't really matter if the underlying server infrastructure is fundamentally compromised or say legally accessible by a foreign government.

00:11:15: True that's why this speed of these threats is forcing a massive shift toward digital sovereignty and deep trust.

00:11:22: If you can't trust where your data lives then who actually controls the hardware incident response?

00:11:27: Is kind of pointless

00:11:28: exactly.

00:11:29: Digital sovereignty has transitioned from a political buzzword into a hard non-negotiable procurement requirement.

00:11:36: Yeah, investor role radens observe that German companies aren't just talking about European digital sovereignty anymore.

00:11:41: they're actively choosing European cyber vendors as deliberate strategic buying decision.

00:11:47: They want the tech stack built and controlled within their own legal jurisdiction.

00:11:52: But there is a massive nuance to this that Umer Longer at BRA&E pointed out.

00:11:56: right server location alone does not guarantee data sovereignty.

00:12:00: Exactly, just because your server is physically sitting in a data center and Frankfurt doesn't mean you are sovereign if the cloud-based AI model hosted in another country can see ingest and process that data while your sovereignty as compromised regardless of where the hard drive has bolted down.

00:12:16: Sovereignty is about control an access Not Just Geography.

00:12:21: And to solve this architectural flaw Johann Hesse detailed a sovereign edge stack developed jointly by Secunet, DCSO and Tenzer.

00:12:30: Edge computing meaning processing the data locally right?

00:12:33: Yes exactly this architecture keeps the raw data safely on-premise at the clinic or the manufacturing plant.

00:12:39: it only sends out the absolute minimum anonymized data required for threat detection

00:12:45: so The raw data never actually leaves the building

00:12:47: Exactly.

00:12:48: And hardware is also racing to catch up to this demand.

00:12:52: Manuel Rodriguez mentioned Pyramid Computer and Scality, showing off fully NIS-II compliant European object storage.

00:12:59: Which is huge since NIS II is that sweeping European cybersecurity directive demanding stricter supply chain security.

00:13:07: Right And on the identity side, Pierre Heinlein highlighted opencloud.eu's live login using EUDI wallet which is a European digital identity framework.

00:13:18: The entire goal there is to build a European ecosystem that just doesn't rely on external infrastructure for basic trust.

00:13:25: Yeah, but if we take the concept of Trust down to its absolute deepest microscopic layer We have talk about cryptography.

00:13:34: Oh man Tariq A framed the looming threat of quantum computing perfectly On this front.

00:13:40: everyone talks about Q-Day.

00:13:41: you know the hypothetical day.

00:13:43: Quantum computers become powerful enough To break standard internet encryption.

00:13:47: Yeah, but Tariq pointed out your actual deadline isn't Q-Day.

00:13:51: It is Q-day minus your migration time.

00:13:53: That's a terrifying way to look at it.

00:13:56: Right?

00:13:56: And Key Exchange which how two computers secretly agree on password over public network Is the most exposed element of entire infrastructure

00:14:05: Because you can't just flip switch when quantum computer comes online.

00:14:10: Migrating cryptographic systems takes years.

00:14:12: Exactly Laurent Barraje from Idemia argues that this level of digital trust has to start at the physical hardware layer, a Hardware Root Of Trust.

00:14:22: Like there's SpheroHSM right?

00:14:24: Right

00:14:25: An HSM or Hardware Security Module is essentially A physical tamper-proof vault for your cryptographic keys.

00:14:31: you protect The math by protecting the metal

00:14:34: yes and we saw incredible innovation At That Physical Layer.

00:14:38: Roger Heybits from Sandgrain showcased a solution for IoT devices that uses IC-based authentication, Integrated Circuit Authentication.

00:14:47: So instead of using a digital password they use a unique physically embedded secret?

00:14:52: Right!

00:14:53: They rely on actual intentional metal traces inside the chip that form with microscopic imperfections during manufacturing.

00:15:00: Oh wow So it creates a physical fingerprint that mathematically cannot be cloned, even by the manufacturer.

00:15:07: Exactly!

00:15:08: You are no longer trusting a digital password.

00:15:10: they could be stolen.

00:15:11: you're trusting unclonable physical chemistry.

00:15:14: That physical certainty is exactly what we need because our digital indicators of trust are just failing us.

00:15:20: Someone named Syed posted this really powerful analogy about the trap-of-the-browser padlock icon.

00:15:26: Oh yeah people see that little padlock next to a URL, and they completely stop thinking.

00:15:31: They just assume their data is

00:15:32: safe.".

00:15:33: But the padlock only means that connection between you and the server's encrypted so no one can listen in on the wire?

00:15:40: It says absolutely nothing about who owns the domain of the other end!

00:15:44: Exactly – That it how homograph attacks work… where attackers use foreign characters that look exactly like English letters...to fake a URL.

00:15:52: The padlock shows up but your connected with a scammer.

00:15:55: Said analogy was brilliant.

00:15:57: It's like hiring a highly secure, heavily armored truck to transport your life savings.

00:16:01: But you accidentally handed the driver the address of a known bank robber.

00:16:05: The journey was incredibly secure but the destination was a complete trap.

00:16:09: Attackers have realized they don't need to break the cryptography if They can just paint A fake Bank sign over the destination.

00:16:17: it is Incredibly easy To fake human visual checks

00:16:21: Which Is why the industry is pushing so aggressively for these verifiable hardware backed identities, from the metal traces in an IOT chip all the way up to the spiffy frameworks.

00:16:31: For AI agents we talked about earlier.

00:16:34: it really all connects back to the beginning.

00:16:36: From locking down AI permissions To surviving a twenty four hour compliance clock to physically unclonable chips We are desperately trying to build systems that don't rely on blind trust.

00:16:47: And yet there is one final provocative thought building on an observation from Tobias Rose at the event.

00:16:54: Yeah, we have just spent this entire deep dive talking about autonomous AI agents machine readable regulations sixty-second deepfakes and quantum cryptography.

00:17:04: But of the end of day cyber security is still fundamentally about people.

00:17:08: Humans are the ones who define the acceptable risks humans write The flawed code that the AI exploits

00:17:15: And humans are the one's who ultimately get tricked by the deep fake phone call.

00:17:19: As our technology gets increasingly autonomous, we have to remember that the ultimate vulnerability and the ultimate defense isn't silicon.

00:17:26: It's carbon.

00:17:28: So in The Rush To Govern Your AI Agents And Automate Your Compliance Are You Forgetting To Secure And Empower The Human Element?

00:17:36: If

00:17:39: you enjoy this episode new episodes drop every two weeks.

00:17:42: Also Check Out Our Other Editions On Cloud Insights In Sovereignty ICT & Tech Insights digital products and services, AI in agentic systems green ICT and sustainable AI defense tech and health tech.