Identity Powered Zero Trust

Valentin Bourneuf, a customer success manager at Okta with a background in network security, GRC consulting and cloud security, argues identity belongs at the center of Zero Trust programs, framing the talk as one of few at the conference to focus specifically on identity rather than Zero Trust in general. He opens with fundamentals: authentication versus authorization, the three identity domains (employee, customer, machine), and how role- and group-based access control emerged to tame growing complexity. He walks through pressures reshaping identity: cloud adoption, BYOD and hybrid work, executive pressure to do more with less, compliance frameworks such as Quebec's Law 25, and statistics showing most breaches involve compromised or stolen credentials. He critiques "Zero Trust" as a semantically unattainable name, then reframes it around NIST's principles (least privilege, no implicit trust, continuous monitoring) and CISA's maturity model. He details how identity providers enrich access decisions with user, device and contextual signals, and closes on three implementation challenges: business agility, cross-tool integration and signal sharing, and balancing security friction against user experience.