Continuous Compliance for Identity Management: from Security Testing to Trustworthy AI Agents

February 8, 2027 ยท Siena, Italy

Co-located with the Joint National Conference on Cybersecurity (ITASEC27).

Overview

Identity Management (IdM) solutions control who can access what, in companies and in public administrations, including complex digital ecosystems and critical infrastructures. Getting their security right matters in practice, and it is also crucial for regulations such as NIS2, CRA, and DORA, which require organizations to manage risk, control access, and continuously assess their security posture. Under a Zero Trust approach no identity is trusted by default, whether it belongs to a human, a machine, or a third-party component in the supply chain. This means IdM deployments cannot just be checked once: they need to be tested and verified on an ongoing basis. In practice, though, vulnerability assessment, security testing, and compliance checks are usually handled as separate activities, with little integration into a single, repeatable process aligned with NIS2 and based on real-world Best Current Practices.

CITA workshop is about bringing these activities together, using IdM as the main application area and Zero Trust as the guiding idea. We are interested in tools and methods for testing whether IdM protocols such as SAML, OAuth 2.0, and OpenID Connect follow known Best Current Practices, in integrating this kind of testing into CI/CD pipelines, in automatically producing the evidence needed for NIS2, CRA, and DORA compliance, and in the security challenges introduced by third-party components in the software supply chain. A further, recent emerging topic is identity, authentication, and authorization for AI agents. AI agents are increasingly given their own credentials and permission to act on behalf of users or other software. This creates a new kind of non-human identity that existing IdM protocols and NIS2 compliance frameworks were not built to handle: who is the agent acting for, what is it actually allowed to do, and how can that be verified and revoked when needed. The workshop looks at how Zero Trust, security testing, and continuous compliance need to evolve and cover AI agents operating across organizations and supply chains.

Topics of interest include, but are not limited to:

  • Security testing and automated compliance checks for IdM protocols
  • Known attacks and vulnerabilities in IdM deployments
  • Zero Trust in practice, testing and verifying access control
  • Security testing integrated into CI/CD and DevSecOps pipelines
  • Automatically generating compliance evidence for NIS2, CRA, and DORA
  • Continuous risk assessment and conformance checking
  • IdM security in the software supply chain
  • How AI agents are identified, authenticated, and authorized when acting on behalf of users or other software
  • How to test and verify the permissions granted to AI agents
  • Real-world case studies from industry and national or European projects