San Francisco Identity Access Management Summit 2027

Beat the rush and join us early for complimentary barista-made coffee and breakfast.

Identity has become one of the biggest security risks facing organisations. As machine identities grow rapidly and AI agents begin acting on behalf of people, traditional approaches to identity and access are no longer enough. This keynote explores why identity is now central to enterprise security, what's driving this change, and how organisations can prepare for 2027.

• How machine and non-human identities are creating new security risks.
• Why identity needs to move from compliance to active defence.
• How verified digital ID, agentic AI, and post-quantum security will shape the next two years.

Government-backed and industry digital identity schemes are moving into mainstream private-sector use, and organisations face a genuine strategic choice: become an early relying party, wait, or build alongside. This keynote unpacks where verified digital identity adoption stands, what participation practically requires, and how leading organisations are turning verified identity from a compliance obligation into a trust and onboarding advantage.

• Where private-sector adoption of verified digital identity stands and what participation practically requires.
• How verified digital ID reshapes customer onboarding, fraud reduction, and KYC.
• The commercial and privacy trade-offs of relying on an external, government-backed identity system.

Autonomous AI agents are now provisioning access, calling APIs, and making decisions on users' behalf, yet most organisations have no framework to govern them. This panel brings together security leaders wrestling with the non-human identity governance vacuum: how to authenticate, authorise, monitor, and revoke identities that never sleep, multiply fast, and increasingly act on their own.

• Practical models for issuing, scoping, and retiring non-human and agent identities.
• Who owns accountability when an autonomous agent exceeds its authority.
• Where existing IAM tooling breaks down against agentic AI, and what fills the gap.

With passkeys crossing into the mainstream and a large majority of enterprises now deploying them, passwordless is no longer aspirational. In this case study, a practitioner walks through a real phishing-resistant authentication rollout: the pilot, the pushback, the edge cases (shared devices, legacy apps, deskless workers), and the measurable impact on help-desk load and account takeover.

• A phased rollout playbook that survived contact with real users and legacy systems.
• How passwordless changed the help-desk, phishing, and account-takeover numbers.
• The edge cases that nearly derailed it and how they were handled.

A hands-on, interactive session working through a real identity and access scenario as a room. Details announced soon.

Standing privileges remain the fastest path from a single compromised credential to full breach. This case study details how one organisation re-architected privileged access management inside a zero-trust model and wired it into identity threat detection and response (ITDR), moving from static admin accounts to just-in-time access with live detection of identity-based attacks.

• Moving from standing privileges to just-in-time, zero-standing-access models.
• Integrating PAM with ITDR to catch credential misuse as it happens.
• What the first detected identity attack revealed about the old approach.

With deepfake-driven identity fraud surging and synthetic-voice attacks targeting help desks and executives, traditional verification is failing. In this case study, a leader shares how their organisation hardened identity proofing and high-risk transactions against generative-AI impersonation across the contact centre, executive workflows, and customer onboarding.

• Where deepfakes actually broke existing verification and approval processes.
• Layered defences: liveness, behavioural signals, and out-of-band verification.
• Rebuilding help-desk and executive-approval workflows to assume impersonation.

Post-quantum standards are final and migration timelines are now set, but identity systems, certificates, tokens, and signing keys are among the hardest things to make crypto-agile. "Harvest now, decrypt later" makes this urgent even before quantum computers arrive. This panel maps a realistic path from crypto-inventory to migration for the identity stack specifically.

• Why identity and PKI are among the thorniest parts of the PQC migration.
• Building crypto-agility so algorithms can be swapped without re-architecting.
• A pragmatic sequencing of what to inventory, prioritise, and migrate first.

Small-group, discussion-based sessions where you'll work through real identity and access challenges with peers in similar roles. Roundtable topics will be announced soon.

Put your knowledge to the test in this fast-paced quiz covering real-world trivia, key concepts, and emerging trends. Compete for bragging rights — and a voucher — as the top scorer takes the crown.

Most organisations don't have one IAM problem, they have a decade of them stitched together: legacy directories, M&A leftovers, siloed cloud IAM, and a team too stretched to fix it properly. This case study follows a practitioner who consolidated a genuinely fragmented identity estate without a green-field budget or headcount, showing what got prioritised, what got cut, and how they built internal buy-in to sustain it.

• How they sequenced consolidation to show quick wins before asking for more budget.
• Where they deliberately chose "good enough and shipped" over "perfect and stalled".
• Closing the skills gap through upskilling and vendor partnership rather than new hires.

As biometrics and behavioural signals become core to authentication, the hardest questions are no longer technical but ethical: consent, bias, proportionality, and what happens when identity data is compromised. This closing keynote argues that durable identity security is as much cultural as technical and lays out how to embed privacy-respecting, identity-first thinking across the whole organisation.

• Governing biometrics ethically: consent, bias, retention, and proportionality.
• Turning identity-first security from a security-team mandate into a company-wide culture.
• Balancing frictionless user experience with privacy and defensibility.

Every organisation is fighting the same three constraints — integration, budget, and skills — while the threat surface keeps expanding. This interactive session puts the strategic trade-offs directly to the room, using live voting to surface where the audience really stands versus where the market says they should be, then debating the gaps.

• What is the single biggest blocker to a unified identity program in your organisation: integration complexity, budget, in-house skills, or executive buy-in?
• Who should own non-human and AI-agent identity? IAM, platform/DevOps, security operations, or a new dedicated function?
• Where will you spend your next identity dollar: passwordless, non-human identity governance, ITDR/observability, or post-quantum readiness?
• Is your organisation's position on verified digital ID schemes "adopt now," "wait and watch," or "build our own"?
• How ready is your identity stack for AI-driven threats today: well-defended, partially, or effectively blind?

Unwind with your peers for a couple of drinks on us!

Beat the rush and join us early for complimentary barista-made coffee and breakfast.

Identity has become one of the biggest security risks facing organisations. As machine identities grow rapidly and AI agents begin acting on behalf of people, traditional approaches to identity and access are no longer enough. This keynote explores why identity is now central to enterprise security, what's driving this change, and how organisations can prepare for 2027.

• How machine and non-human identities are creating new security risks.
• Why identity needs to move from compliance to active defence.
• How verified digital ID, agentic AI, and post-quantum security will shape the next two years.

Government-backed and industry digital identity schemes are moving into mainstream private-sector use, and organisations face a genuine strategic choice: become an early relying party, wait, or build alongside. This keynote unpacks where verified digital identity adoption stands, what participation practically requires, and how leading organisations are turning verified identity from a compliance obligation into a trust and onboarding advantage.

• Where private-sector adoption of verified digital identity stands and what participation practically requires.
• How verified digital ID reshapes customer onboarding, fraud reduction, and KYC.
• The commercial and privacy trade-offs of relying on an external, government-backed identity system.

Autonomous AI agents are now provisioning access, calling APIs, and making decisions on users' behalf, yet most organisations have no framework to govern them. This panel brings together security leaders wrestling with the non-human identity governance vacuum: how to authenticate, authorise, monitor, and revoke identities that never sleep, multiply fast, and increasingly act on their own.

• Practical models for issuing, scoping, and retiring non-human and agent identities.
• Who owns accountability when an autonomous agent exceeds its authority.
• Where existing IAM tooling breaks down against agentic AI, and what fills the gap.

With passkeys crossing into the mainstream and a large majority of enterprises now deploying them, passwordless is no longer aspirational. In this case study, a practitioner walks through a real phishing-resistant authentication rollout: the pilot, the pushback, the edge cases (shared devices, legacy apps, deskless workers), and the measurable impact on help-desk load and account takeover.

• A phased rollout playbook that survived contact with real users and legacy systems.
• How passwordless changed the help-desk, phishing, and account-takeover numbers.
• The edge cases that nearly derailed it and how they were handled.

A hands-on, interactive session working through a real identity and access scenario as a room. Details announced soon.

Standing privileges remain the fastest path from a single compromised credential to full breach. This case study details how one organisation re-architected privileged access management inside a zero-trust model and wired it into identity threat detection and response (ITDR), moving from static admin accounts to just-in-time access with live detection of identity-based attacks.

• Moving from standing privileges to just-in-time, zero-standing-access models.
• Integrating PAM with ITDR to catch credential misuse as it happens.
• What the first detected identity attack revealed about the old approach.

With deepfake-driven identity fraud surging and synthetic-voice attacks targeting help desks and executives, traditional verification is failing. In this case study, a leader shares how their organisation hardened identity proofing and high-risk transactions against generative-AI impersonation across the contact centre, executive workflows, and customer onboarding.

• Where deepfakes actually broke existing verification and approval processes.
• Layered defences: liveness, behavioural signals, and out-of-band verification.
• Rebuilding help-desk and executive-approval workflows to assume impersonation.

Post-quantum standards are final and migration timelines are now set, but identity systems, certificates, tokens, and signing keys are among the hardest things to make crypto-agile. "Harvest now, decrypt later" makes this urgent even before quantum computers arrive. This panel maps a realistic path from crypto-inventory to migration for the identity stack specifically.

• Why identity and PKI are among the thorniest parts of the PQC migration.
• Building crypto-agility so algorithms can be swapped without re-architecting.
• A pragmatic sequencing of what to inventory, prioritise, and migrate first.

Small-group, discussion-based sessions where you'll work through real identity and access challenges with peers in similar roles. Roundtable topics will be announced soon.

Put your knowledge to the test in this fast-paced quiz covering real-world trivia, key concepts, and emerging trends. Compete for bragging rights — and a voucher — as the top scorer takes the crown.

Most organisations don't have one IAM problem, they have a decade of them stitched together: legacy directories, M&A leftovers, siloed cloud IAM, and a team too stretched to fix it properly. This case study follows a practitioner who consolidated a genuinely fragmented identity estate without a green-field budget or headcount, showing what got prioritised, what got cut, and how they built internal buy-in to sustain it.

• How they sequenced consolidation to show quick wins before asking for more budget.
• Where they deliberately chose "good enough and shipped" over "perfect and stalled".
• Closing the skills gap through upskilling and vendor partnership rather than new hires.

As biometrics and behavioural signals become core to authentication, the hardest questions are no longer technical but ethical: consent, bias, proportionality, and what happens when identity data is compromised. This closing keynote argues that durable identity security is as much cultural as technical and lays out how to embed privacy-respecting, identity-first thinking across the whole organisation.

• Governing biometrics ethically: consent, bias, retention, and proportionality.
• Turning identity-first security from a security-team mandate into a company-wide culture.
• Balancing frictionless user experience with privacy and defensibility.

Every organisation is fighting the same three constraints — integration, budget, and skills — while the threat surface keeps expanding. This interactive session puts the strategic trade-offs directly to the room, using live voting to surface where the audience really stands versus where the market says they should be, then debating the gaps.

• What is the single biggest blocker to a unified identity program in your organisation: integration complexity, budget, in-house skills, or executive buy-in?
• Who should own non-human and AI-agent identity? IAM, platform/DevOps, security operations, or a new dedicated function?
• Where will you spend your next identity dollar: passwordless, non-human identity governance, ITDR/observability, or post-quantum readiness?
• Is your organisation's position on verified digital ID schemes "adopt now," "wait and watch," or "build our own"?
• How ready is your identity stack for AI-driven threats today: well-defended, partially, or effectively blind?

Unwind with your peers for a couple of drinks on us!