Agenda & Speakers

Beat the rush and join us early for complimentary barista-made coffee and breakfast.

Kick off the day with a welcome from your MC and a look at what's ahead.

MFA can work exactly as intended and the account can still be compromised. Once a user has authenticated, attackers can target the session, token or browser state created afterwards and use it without going through the login process again.

This session looks at how one organisation is protecting access after authentication succeeds, how quickly stolen sessions can be identified and what has to happen when a trusted session suddenly becomes untrusted.

We'll cover:

• Where session and token theft gets around controls that worked correctly at login
• Which signals can show that an authenticated session has changed hands
• How teams revoke access quickly without forcing every user through constant reauthentication

With Australia's Digital ID system now opening to the private sector under the Digital ID Act, organisations face a genuine strategic choice: become an accredited relying party, wait, or build alongside. This keynote unpacks where the rollout actually stands, the accreditation and cost realities of myID and the AGDIS, and how leading organisations are turning verified digital identity from a compliance obligation into a trust and onboarding advantage.

• Where the private-sector rollout stands and what accreditation practically requires
• How verified Digital ID reshapes customer onboarding, fraud reduction, and KYC
• The commercial and privacy trade-offs of relying on a government-backed identity system

Identity now sits in front of almost everything employees need to do. If a core identity platform is compromised or unavailable, recovering the rest of the business can depend on getting identity working first.

This panel looks at how organisations prepare for an identity outage or compromise, what needs to be recoverable first and whether their plans would actually work under pressure.

We'll discuss:

• What has to come back first when the identity layer itself cannot be trusted
• How organisations design break glass access, backup and clean recovery
• How often identity recovery should be tested before an incident proves the plan wrong

Authentication answers who someone is. It does not necessarily answer whether they should be allowed to perform a particular action against a particular resource at this moment.

This session looks at how organisations are moving away from access decisions buried inside applications and towards policies that can make more specific decisions based on identity, context and risk.

We'll cover:

• Where roles and static permissions stop being specific enough
• How access decisions can change based on the user, resource, action and current context
• What it takes to apply consistent authorisation across applications, APIs and AI agents

Recharge with refreshments and structured networking with your peers.

A hands-on, interactive session working through a real identity and access scenario as a room. Details announced soon.

One permission may look harmless. Several permissions connected across Active Directory, Entra, cloud platforms and applications can create a route to something far more powerful.

This session looks at how one organisation mapped those connections, found paths an attacker could use to move from an ordinary identity to critical access and decided which ones to remove first.

We'll cover:

• How seemingly low risk permissions can combine into a serious access path
• Which identity relationships traditional access reviews are most likely to miss
• How teams prioritise remediation when hundreds of possible paths are uncovered

Passkeys and phishing resistant authentication make stealing a password far less useful. That does not mean every route into the account has disappeared.

This session looks at what happens after organisations strengthen the login and attackers start targeting weaker fallback methods, authenticator enrolment, new devices and account recovery instead.

We'll cover:

• Which fallback routes can undo the protection gained from stronger authentication
• How enrolment and recovery should change once passwords are no longer the main control
• What organisations need to remove rather than simply adding another authentication method on top

From 15 March 2027, public TLS certificates max out at 100 days. That turns certificate renewal from an occasional operational task into a continuous automation problem and exposes the wider issue of how organisations discover, own and rotate machine identities at scale.

This panel looks at how organisations are automating certificates and other machine credentials before shorter lifetimes make manual processes unmanageable.

We'll discuss:

• How organisations discover certificates, keys and machine credentials they did not know they had
• What needs to be automated across issuance, renewal, rotation and revocation
• How teams deal with ownership gaps and prevent expired or forgotten credentials from becoming outages or security exposures

Small-group, discussion-based sessions where you'll work through real identity and access challenges with peers in similar roles. Roundtable topics will be announced soon.

Enjoy a complimentary lunch while connecting with fellow attendees.

Put your knowledge to the test in this fast-paced quiz covering real-world trivia, key concepts, and emerging trends. Compete for bragging rights (and a travel voucher) as the top scorer takes the crown.

Strong authentication does not help if an attacker can persuade a service desk to reset MFA, enrol a new device or recover an account.

This session looks at how organisations are tightening the human side of identity recovery and what evidence should be required before somebody is given control of an account again.

We'll discuss:

• How organisations prove someone is really who they claim to be when normal authentication is unavailable
• Which recovery and enrolment processes create the biggest gaps
• Where service desks should be allowed to make the call and when a request should be stopped or escalated

Permanent privileged access is convenient, but it also means powerful permissions are sitting there whether somebody needs them or not.

This session looks at what it takes to replace standing access with temporary privilege, how organisations handle emergency and overnight access and what happens when security controls meet the reality of administrators and developers trying to do their jobs.

We'll cover:

• Which privileged roles can realistically move to temporary access
• How approval, emergency access and on call work once permanent admin rights disappear
• What broke during the change and where standing privilege still proved difficult to remove

Large identity environments rarely look the way anyone would design them today. Years of mergers, platform changes, legacy applications and point solutions leave organisations running multiple identity providers, directories and authentication methods at the same time.

This think tank puts that reality to the room, panelists and audience together, to work through what should actually be removed, replaced or tolerated if organisations had the chance to simplify the identity environment now.

Questions we'll cover:

• If you were designing your identity environment from scratch today, what would you keep and what would you refuse to rebuild?
• Which identity providers, directories or authentication methods are you maintaining today mostly out of habit rather than necessity?
• What's one legacy application everyone agrees needs to be modernised, wrapped or retired, but nobody has actually touched?
• Where does consolidation genuinely reduce risk and cost, and where is it just movement without real benefit?
• How do you sequence identity simplification so it delivers value along the way, rather than becoming another multi-year transformation that never finishes?

Wrap-up of the day's key takeaways, and your chance to win some epic prizes.

Unwind with your peers for a couple of drinks on us!

See you at Identity World New York on May 6, 2027.