Advancing App Security for a New Era of Threats

As organizations shift to cloud-native architectures, securing workloads becomes increasingly complex. Traditional methods like hardcoded secrets and service accounts were designed for static systems, not the dynamic, distributed applications we build today. In this session, learn the concept of Trusted Workload Identity—a new approach that doesn’t just manage secrets but verifies identity at runtime using open standards and cutting-edge security practices.

Join cybersecurity advocate Sal Kimmich for an accessible introduction to key technologies like SPIFFE, SPIRE, JWT-SVIDs, and confidential computing. You’ll learn how these tools work together to automatically assign cryptographic identities to workloads and enable secure, policy-driven communication across clouds, containers, and even serverless functions.

Whether you’re a developer, DevSecOps engineer, or app security lead, this session will help you understand how workload identity fits into modern application security—and why it’s quickly becoming a critical piece of secure-by-design infrastructure.

Key Takeaways:
- Why legacy secret management no longer meets today’s security demands.
- What "workload identity" means and how it's different from user authentication.
- How open-source tools like SPIFFE and SPIRE simplify identity and trust.
- What confidential computing adds to runtime verification and secure execution.
- Practical steps to start implementing workload identity in your environment.