How should organisations use an Identity Festival event to evaluate IAM and IGA priorities?

Why This Matters for Security Teams

An Identity Festival event is most useful when it forces IAM and IGA teams to compare operational friction against business outcomes. The real question is not which platform looks strongest on paper, but whether current controls can support faster access reviews, cleaner governance, and Zero Trust execution without adding manual work. NHI programmes often surface the same problem in a different form, and the Ultimate Guide to NHIs shows why: non-human identities outnumber human identities by 25x to 50x in modern enterprises, yet many teams still manage them with human-centric processes. NIST also reinforces that identity governance must map to control objectives, not tool features, in NIST SP 800-53 Rev 5 Security and Privacy Controls.

At an event, the highest-value discussions usually expose whether a team needs automation, better deployment sequencing, or tighter compliance evidence. That framing matters because IAM failures rarely start as a dramatic outage; they start as slow reviews, inconsistent approvals, and exception handling that becomes normalised. In practice, many security teams encounter that drift only after audit pressure, access sprawl, or a breach has already made the gaps obvious.

How It Works in Practice

Use the event as a structured prioritisation exercise. Start by translating current pain points into three buckets: access lifecycle, governance workflow, and control assurance. If reviews are slow, focus on IGA automation and recertification design. If onboarding and offboarding are inconsistent, look at provisioning orchestration, role modelling, and ownership clarity. If compliance is the driver, test how well the programme produces evidence for NIST SP 800-53 Rev 5 Security and Privacy Controls without manual reconstruction.

The conversation should also separate strategic goals from product features. A mature IAM roadmap usually asks:

• Which identities create the most operational risk today?
• Where do approvals, exceptions, and role definitions break down?
• What must be automated before expanding the platform?
• Which controls need tighter policy enforcement versus better reporting?

For non-human identities, this becomes even more important. The 2024 Non-Human Identity Security Report found that 88.5% of organisations say their non-human IAM practices lag behind or only match their human IAM efforts. That gap is a strong signal that identity governance is often underbuilt for service accounts, API keys, and other workload identities. Use the event to validate whether your team needs stronger secret lifecycle controls, faster revocation, or cleaner ownership before you invest in broader tooling. These controls tend to break down in hybrid environments where identity data is fragmented across cloud, SaaS, and CI/CD systems because no single team owns the full lifecycle.

Common Variations and Edge Cases

Tighter governance often increases process overhead, so organisations have to balance speed against control depth. That tradeoff matters because an Identity Festival conversation can easily over-index on platform consolidation when the real issue is operating model maturity. Current guidance suggests the best programme priorities depend on whether the organisation is trying to reduce review backlog, close compliance gaps, or improve Zero Trust readiness.

Some environments need sequencing before expansion. If role data is messy, automation will only scale bad decisions. If policy ownership is unclear, IGA will expose disagreements rather than solve them. If the organisation is still struggling with secrets sprawl or privileged service accounts, the right priority may be governance foundations rather than a broader IAM rollout. NHIMG research on the Top 10 NHI Issues and breach patterns in 52 NHI Breaches Analysis both point to the same lesson: identity programmes fail when teams treat tooling as the plan instead of the enabler.

For that reason, the event should end with a decision on scope, sequencing, and success measures. Best practice is evolving, but the practical aim is clear: define which identities, which workflows, and which controls must improve first, then tie that to measurable outcomes such as review cycle time, entitlement accuracy, and revocation speed.

Related resources from NHI Mgmt Group

• How should organisations use SOC 2 Type II evidence when evaluating IAM and identity governance providers?
• How should identity teams use an IAM event to improve governance maturity rather than just attend sessions?
• How should IAM leaders use event networking to improve identity security programmes without turning it into a sales pitch?
• How should organisations decide when to use passkeys versus digital identity credentials?