ATLSECCON 2026

“Treat servers like cattle, not pets” captured one of the biggest shifts in how we run infrastructure. Going from servers we named with masking tape on the case to infrastructure-as-code to deploy thousands of processes changed the mental model around authentication and authorization.

Now, AI agents are forcing another mental shift, as we anthropomorphize these nondeterministic autonomous processes. Many people in the industry are now contemplating how we should handle delegation, security, and identity for these agentic systems.

We will look to answer why human and non-human identity management diverged and what that means to various parts of our organizations.

This talk will look at the state of authentication and authorization across services today and how we got here. The audience will walk away with a much better sense of where we are headed with machine-to-machine authentication, covering:
- Istio and Envoy
- SPIFFE/SPIRE
- WIMSE and Workload Identity Tokens (WIT)
- Federated Identities on Cloud Providers