Ping YOUniverse: Why the identity paradigm needs to change

AUSTIN, TEXAS — Andre Durand, CEO and founder of Ping Identity, kicked off his company's North American Ping YOUniverse conference here today (Sept. 1) with a call to change the paradigm around identity security. It's a change he said is necessary as AI agents are implemented everywhere.

"Agentic speed changes the economics of trust," he said. He added that until now, "we've lived with two gates" — one controlling administration, the other entry.

Access to systems required both to be true, Durand said, and "this worked as long as we were talking about humans."

Please click here to watch a recording of Durand's keynote address at Ping YOUniverse.

But in the age of agentic AI, he explained, that system breaks down. Human oversight and approval simply can't keep up with machine speed. Furthermore, the growth of identity-related cybercrime has reached crisis level.

"Every identity gateway right now is under attack," Durand explained, because "the identity system is upstream from everything of value."

"A lot of good people are going to become victims of scams," he said, citing the experiences of the residents of his own father's retirement community.

"Trust is being weaponized," Durand said, and the smartphone has become a weapon for attackers.

Meanwhile, he added, everyone's trying to maximize AI innovation but at great risk.

"We all feel we've got to go faster," he said, but "the cost of speed is trust."

Because of these changes, he said, "every step in the ID journey must evolve," and trust must be earned through continuous validation.

To achieve this, Durand explained, we need to merge the previously separate processes of fraud detection, access management, and identity verification.

We need to apply zero trust across the entire identity ecosystem, he said. It can't be just regular zero trust, but zero trust with just-in-time (JIT) access and limited (or "just enough") privileges — the combination of which is the only thing Durand thinks can adequately govern agentic AI.

"Any trust that is too long-lived or too permissive is a risk," he explained.

Most importantly, he said, we need to shift the heavy lifting of identity systems from authentication (is this user really this user?) to authentication (is this user allowed to perform this task and/or access these systems?).

"In the agentic era, the gate that matters is the one that covers action," Durand said. "Authorization becomes the new moat," and authentication is just a prerequisite.

Shifting these processes and implementing JIT access and limited privileges will cost time and money, he clarified.

We've known how to do it for some time, Durand added, "but until now, the pearl has not been worth the dive."

Durand also announced three new initiatives:

"Access, privilege and governance are converging," Durand told the audience of Ping Identity customers. "You have our commitment to complete that convergence."

In a brief discussion following his keynote, Durand brought out Johnny Deutsch, Senior VP at LPL Financial, to talk about how LPL implemented new AI-driven verification procedures to its client base of wealth-management advisors.

"Wealth managers are all about interaction with individual investors," Deutsch explained. "AI frees them up to spend more time with customers."

"You've basically made these wealth advisors super-smart. What does it mean to govern AI?" Durand asked.

"Don't inherit the controls you have from the user. Agents need to have time-bound authorization," replied Deutsch. "The human is the advisor, not the AI. Every authorization has to be on an agent-by-agent basis."

Asked for his definition of careful, safe AI, Deutsch answered: "We need to have clarity for every use case."