Programme

Chair of the Conference Amardeep warmly welcomes you to the plenary hall during Identity & Access Management 2026 and will walk you through today’s agenda.

In the NFL, preparation, teamwork and split-second decision-making are critical, both on and off the field. The same applies to cybersecurity, where resilience depends on strong leadership, clear playbooks and the ability to respond under pressure. In this session, Kam shares practical insights on building a resilient security organisation, preparing for cyber incidents and protecting critical digital ecosystems where trust, availability and reputation are always on the line. Attendees will gain a leadership-focused perspective on how to turn cyber resilience into a strategic capability.

AI agents are moving from answering questions to taking actions across enterprise systems, creating new IAM questions: who is acting, on whose behalf, what can it do, and when should a human approve? This practical session introduces a runtime identity model for agentic AI, covering distinct agent identity, explicit delegation, least-privilege and contextual authorisation, human oversight and auditability. Through realistic enterprise scenarios and reference architecture patterns, attendees will explore how the same agent can be allowed to perform a routine task, denied access beyond its authority and challenged before a sensitive action. The session concludes with a practical checklist for assessing whether an organisation’s IAM architecture is ready for agentic AI. It is designed as an educational, discussion-led session using scenarios and architecture patterns to make the concepts concrete.

AI coding agents are running inside most organizations today (whether they know it or not), operating under a developer’s identity and with that developer’s full privilege. In this session we’ll show you, how to find AI agents on your endpoints, including the ones nobody approved and then stops them at the point of action, before the command runs rather than after it’s logged. Same machine, same credentials: human allowed, agent blocked. We’ll finish by mapping what agentic identities can actually reach across your cloud estate, and where they might be vulnerable to abuse

Customer identity can make your business tick or stall. Login friction, cumbersome MFA and SSO, identity silos, and legacy APIs can be the difference between lifelong customer relationships and dropoffs. This session will cover learnings from real-world deployments and highlight how the right identity approach can help organizations streamline customer onboarding, provide self-service experiences to business customers and partners, balance security and usability, and securely adopt AI agents and MCP servers.

By 2028, the average enterprise will deploy over 150,000 autonomous AI agents. But as agents gain autonomy, security teams face a fundamental challenge: standard logins and static permissions weren't built for software that acts on its own. In this 25-minute session, Okta shares a practical approach to securing AI without slowing down innovation. Grounded in the Blueprint Alliance—a joint effort with companies like AWS, Google, Salesforce, and ServiceNow—we'll cover four essential controls for managing AI agents: finding where they operate, scoping their access, monitoring their work, and instantly shutting them down if they step out of line. This gives security leaders a clear framework to safely enable AI across the business.

In today's digital landscape, identity has undeniably become the new perimeter, yet managing it across fragmented, multi-vendor environments introduces massive complexity. To eliminate hidden vulnerabilities, forward-thinking organisations are shifting towards centralised visibility that spans all identity providers without locking themselves into a single vendor. It is also time to break down old silos: transforming IAM from a purely IT function into a shared responsibility with the CISO ensures that identity decisions are backed by deep, necessary security context.

In the modern AI enterprise, elevated privileges are no longer restricted to a small group of system administrators; every identity now operates with broad access to critical systems. Based on the Idira platform approach, David Higgins explores how traditional Privileged Access Management (PAM) must evolve into a unified identity security control plane. The session will examine how organizations can extend dynamic privilege controls, zero standing privileges, and governance across all three core identity tiers: human users, automated machine workloads, and emerging autonomous AI/agentic identities. Delegates will gain insights into discovering hidden identity risks, applying just-in-time access, and securing the entire identity lifecycle to minimize attack surface without slowing business innovation.

A 50-minute live incident, not a workshop. The audience sits in the CISO seat as an AI-enabled identity attack unfolds in real time, deepfake authority, valid-looking access, and a story that gets ahead of the facts. Using on-the-spot votes, participants will take the decisions as if they were involved in a real incident: stop the payment, contain the issue, call the Board, or keep the business moving. Each choice has a consequence. The session challenges the one that identity is still something you can recognise. Leave with practical questions on verification, privileged access, incident command and accountability when AI makes the attacker look like someone you already trust.

AI is changing the way organisations think about identity, access and control. In this session, Hargreaves Lansdown explores the key challenges around agentic AI, employee use of AI tools and the governance of new digital identities. The session also highlights where AI can create value within IAM, IGA and PAM, with practical examples of how existing frameworks and technology can help reduce risk and strengthen identity programmes.

As organisations modernise their digital infrastructure, legacy IAM environments can quickly become a barrier to scalability, security and innovation. In this session, Vodafone IoT shares practical insights from the journey towards cloud-based IAM. The session explores how to manage complexity, reduce risk and ensure continuity while moving identity and access management to the cloud. Attendees will gain a practical view on the challenges, lessons learned and key considerations for building a more scalable and future-ready IAM environment.

AI agents haven't created the non-human identity problem, they've exposed it. Most organisations can't say how many non-human identities they have, who owns them, or what would break if they were revoked. While human identities follow a clear joiner-mover-leaver process, service accounts, API keys and AI agents often exist without clear ownership or governance. This session explores why non-human identities should be governed just like their human counterparts: with clear ownership, least privilege, attributable actions and visibility into every autonomous process. It also examines why the human identity model doesn't always transfer, and how organisations can close the gap without a dedicated IAM function or a large tooling budget.

Identity is often a critical layer of cyber incidents, yet many organisations still struggle to understand how compromised identities, privileges, access pathways and identity infrastructure influence the scope, investigation and response to an attack. This session explores the identity dimension of cyber defence and what happens when compromised accounts, privileged access and identity infrastructure become part of an active security incident. We will look at the role IAM teams play across containment, coordination with Security Operations, remediation and access recovery, as well as some of the operational gaps that can slow an effective response. The session will be practical and interactive, giving attendees a framework and questions they can take back to their own organisations to assess how prepared their IAM function is for the day identity becomes part of the incident.

AI has moved from answering questions to taking action. Agents are already at work across the enterprise, often given a set of keys rather than an identity of their own. Doing nothing is still a decision. It just gets invoiced later, with interest. In this lively, interactive session (no jargon, no pitch, no panic), Sam uses true stories, quick games and the latest research to show what ungoverned AI really costs and how good governance pays for itself. Attendees will leave with four questions to ask about their AI agents, a quick self-score and a practical plan for Monday morning

As organisations face increasing identity security and governance requirements, budget constraints can make adopting a new IGA platform challenging. This session explores how organisations can leverage their existing Microsoft investment and Microsoft Entra ID Governance to address key IGA requirements. The session will explore practical ways to close identity security gaps, improve access governance and automate identity lifecycle processes using capabilities already available within the Microsoft ecosystem. Attendees will gain a practical view of how to maximise existing investments, prioritise the most critical governance gaps and build a more effective and sustainable IGA approach without necessarily adding another platform.

Managing identity in a global organisation means balancing security, user experience, scalability and increasingly complex access requirements. In this keynote, Mastercard shares perspectives on how identity is evolving from a technical control into a critical business capability. The session explores the challenges of managing access at scale, adapting IAM to changing technologies and user expectations, and building an identity strategy that can support both security and innovation.