I'm A Machine, And You Should Trust Me: The Future Of Non-Human Identity

The talk opens with a quick audience poll contrasting a suspicious phone call with an unexpected offer, to show that people apply gut checks that software does not. Non-human identities such as API keys, service accounts and workloads now outnumber people by wide margins, and the speaker argues that a valid bearer token gets access no matter who presents it. Credentials are often hardcoded, over-scoped and rarely rotated, so a single leaked key lets an attacker act as a machine without exploiting anything.

Using public secret-scanning figures and a practitioner survey, the speaker shows that many leaked secrets stay valid long after discovery. He frames the problem as one of ownership, asking who controls each credential and what its lifecycle and sunset policy is. For the long term, he points to federated workload identity, including SPIFFE and SPIRE and the IETF's emerging workload identity drafts, along with short-lived tokens such as Kubernetes service account tokens for image pulls. For the short term, he proposes finding every secret, moving it into a secret manager, scanning continuously, adding developer tooling such as git hooks, and automating rotation.

The closing message is to build a repeating cycle: raise awareness, assign ownership and write policy, then pick tools and train people. He also urges attendees to look after their own wellbeing while doing this work.