Presented by UberEther & Carahsoft
Cyber adversaries increasingly enter systems with valid credentials and authenticated sessions instead of exploiting the network perimeter. Matt Topper, President of UberEther, says that change is transforming identity and access management from a traditional IT function into a real-time cybersecurity capability.
Speaking at the Billington Cybersecurity Summit 2026, Topper explains that credential theft and password exposure have made it easier for attackers to impersonate legitimate users. Strong credentials such as PIV and CAC cards remain important, but they do not eliminate the danger.
An attacker can wait for an authorized user to authenticate and then steal the resulting session. Because the original login was valid, security tools may continue treating the session as trustworthy while the adversary moves it to another device or location.
“The adversaries are no longer just breaking into the systems; they’re actually just logging in,” Topper says.
Traditional access systems often treat authentication as a single event. Once a person successfully logs in, the system may allow that user to continue working for hours without reassessing the session.
That approach assumes the same person retains control of the session and that the surrounding circumstances do not change. Modern identity attacks undermine both assumptions.
A session may begin on an authorized government laptop and later appear on a different device in another part of the world. Conventional logging tools may still see the valid session identifier and fail to recognize the change as suspicious.
Identity threat detection and response offers a different approach. Instead of granting a user broad standing privileges after the first authentication, the organization continually evaluates what the person is attempting to do.
A user may initially receive access to email. If the person later attempts to administer a sensitive system, the agency can require another authentication step and evaluate additional information before granting access.
Location, behavior and requested privileges can contribute to a stronger profile. A credential may be valid, but an attempt to use it from an unfamiliar device or unexpected region can prompt the agency to challenge or terminate the session.
This approach reflects a central zero-trust principle: trust should not be permanent simply because a user passed one test earlier in the day.
Continuous evaluation also makes it more difficult for an adversary to move laterally. Even if an attacker steals a session, each attempt to reach another application or assume a more powerful role creates a new opportunity for the agency to identify and stop the activity.
Autonomous agents and AI-enabled services add another category of identity that agencies must manage.
An AI agent may need access to an application, database or service to complete a task. That does not mean it should receive broad credentials that work across several systems.
Agencies need to know what the agent is, where it originated, who authorized it and which resources it is permitted to use. They should also prevent the agent from obtaining or sharing credentials that exist inside an application.
Topper compares the risk to someone posting a photograph of a key. The person may focus on something else in the picture, but the image gives another individual the information needed to copy the key. In the same way, an AI system may expose or share a digital credential without recognizing the security consequence.
Identity controls should keep sensitive keys away from agents that do not require them and enforce access at a layer where an application cannot bypass the restriction.
AI also has the potential to help agencies solve longstanding identity-management challenges. Many government organizations operate legacy applications that lack modern interfaces for connecting to identity and access-management platforms.
Integrating those applications manually can require developers to examine old code and create new interfaces one system at a time. For an agency with hundreds of applications, that process could take years.
AI can accelerate the work by analyzing an application and helping create the interface needed to connect it with modern identity services. That can allow agencies to bring legacy systems under centralized access controls faster.
The larger lesson is that identity can no longer be treated as a static credential checked at the front door. Agencies need continuous visibility into people, devices, sessions and autonomous agents throughout every interaction.
Key Takeaways