Why do security leaders still value intimate in-person events in a remote-heavy security environment?

Why This Matters for Security Teams

Security leaders still value intimate in-person events because the most useful intelligence in NHI security is often qualitative: how peers actually handle credential rotation, ownership, and exception management when the audit trail is messy. That kind of context is hard to extract from webinars or vendor-led briefings. It matters more now because remote-heavy operating models can hide the operational friction that drives real risk.

The problem is not just knowledge transfer. It is trust-building around sensitive topics such as over-privileged service accounts, third-party OAuth exposure, and stalled remediation. NHIMG research shows only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, while 85% lack full visibility into third-party vendors connected via OAuth apps in The State of Non-Human Identity Security. That gap is easier to discuss honestly in a small room than in a large broadcast format.

In-person settings also compress the time it takes to compare operating models. Leaders can ask what actually worked during an incident, how policy exceptions were approved, and where ownership sat between security, platform, and application teams. Those details often shape whether controls are adopted or ignored. The NIST Cybersecurity Framework 2.0 remains useful as a common language, but the event value comes from hearing how practitioners translate it into control ownership and daily execution. In practice, many security teams encounter these gaps only after a secrets leak or vendor incident has already forced the conversation.

How It Works in Practice

Intimate events work best when they are structured around peer comparison rather than presentation. The strongest sessions usually put security leaders, identity owners, and platform teams in the same room to discuss one concrete problem: who owns non-human identities, how access is approved, and what gets revoked when a workload, integration, or vendor relationship changes. That is where remote formats often flatten the nuance.

For NHI governance, the useful questions are operational. Are long-lived secrets still embedded in code or CI/CD pipelines? Are service accounts reviewed against actual workload usage, or just tied to a broad role? Is offboarding automatic when an integration is retired? NHIMG data shows 71% of NHIs are not rotated within recommended time frames and 97% carry excessive privileges in The Ultimate Guide to Non-Human Identities, which helps explain why peer discussion often centres on rotation discipline, visibility, and exception handling.

In mature sessions, leaders will also compare how they map these controls to recognised frameworks. The NIST Cybersecurity Framework 2.0 is useful for framing governance and access control, while NHI-specific research helps show where generic IAM language falls short. A good event will surface whether teams are using policy reviews, secrets vaulting, and just-in-time provisioning as actual operating controls or just as aspirational architecture. It also helps to hear where peers are using Schneider Electric credentials breach lessons to change internal approval models and vendor oversight.

These conversations tend to break down when the attendee mix is too broad, because vendor pitches, executive summaries, and tactical identity operations have very different decision horizons.

Common Variations and Edge Cases

Tighter in-person access often increases time and budget costs, so organisations need to balance relationship depth against the reality of distributed teams and limited travel. That tradeoff is worth naming because not every security discussion benefits from a closed-room format.

Best practice is evolving, but current guidance suggests that in-person events are most valuable for high-friction topics: incident response for secrets exposure, third-party access governance, and building consensus on NHI ownership. They are less useful for broad awareness training, which scales better online. The real edge case is when a security team already has strong telemetry but weak internal alignment. In that environment, the event is less about discovering new facts and more about accelerating decisions that have been stalled by organisational ambiguity.

Remote-heavy models also change what leaders should expect from these gatherings. The goal is not to replace formal controls with networking, but to use peer context to sharpen them. That includes deciding whether access reviews should be calendar-based or event-driven, whether JIT access is feasible for specific integrations, and how much trust can be placed in vendor attestations. The most valuable in-person sessions usually end with a clearer view of which controls are repeatable, which are still manual, and which assumptions need to be challenged before the next audit or incident.

Related resources from NHI Mgmt Group

• Why do CISOs and IAM leaders still value in-person peer networking in a remote-heavy security market?
• How can security teams tell whether their remote access model is still too dependent on perimeter trust?
• What breaks when JML processes are still manual in a SaaS-heavy environment?
• What should security and IAM leaders do when users know about MFA but still use passwords?