Enterprises run on cryptography — but hardly anyone can say where it actually lives. TLS gets terminated somewhere in the infrastructure, the container base image decides which OpenSSL you run, algorithms come from library defaults. Everything works, and that’s exactly the problem: healthy cryptography is invisible.

We term this „shadow cryptography”. It’s the functional crypto that nobody sees/manages end to end. Pressure is now building from several directions at once — shrinking certificate lifetimes (browser forum), faster vulnerability discovery (AI), tightening regulation, the post-quantum transition. Different storms, same weakness: not knowing your cryptographic landscape.

Strong authentication has long been considered a topic without a need for innovation. Recently the spotlight is on strong authentication again as new treats have emerged, NIST raised the requirements for government agencies, and FIDO took leadership for security and standardisation. In this speech, we will have a look at the challenges of strong authentication as point-in-time action and focus on emerging solutions such as continuous authentication or continuous adaptive trust (CAT).