Birds of a Feather Session

What a Birds of a Feather session is for

A Birds of a Feather session is designed to create a lightweight forum for open exchange, not a staged presentation slot. Its value comes from letting participants compare priorities, compare operational constraints, and identify where their requirements or pain points overlap before they harden into formal proposals or product decisions.

That makes the format especially useful in security communities, where practitioners often need a low-friction way to describe real-world needs, validate whether others see the same problem, and test whether a topic deserves a deeper working group, roadmap item, or standards discussion.

How the format works in practice

BoF sessions are usually participant-led and intentionally flexible. A facilitator may frame the topic, but the room is expected to steer the discussion through questions, experience-sharing, and comparison of approaches rather than through slides or a fixed agenda.

The format works best when the scope is clear enough to attract the right people, but open enough that unexpected issues can surface. That balance is what makes it different from a panel, a workshop, or a traditional conference talk.

Because the session is informal, the quality of the discussion depends on the participants who show up and the clarity of the problem statement. A strong BoF can reveal terminology mismatches, hidden implementation constraints, and practical trade-offs that are easy to miss in formal forums.

Why Birds of a Feather sessions matter for identity and security teams

For identity, IAM, PAM, and broader security teams, BoF sessions are often a fast way to learn how peers are handling the same control or governance challenge. They are useful when the community needs to compare operating models, understand where tooling falls short, or surface recurring friction around adoption, ownership, or integration.

In practice, the format can also help separate “interesting” ideas from problems that are common enough to justify shared guidance. That is especially valuable in fast-moving areas such as OWASP ASVS, where practitioners benefit from discussing how requirements translate into real environments, and in control-heavy domains where people need a common language for access, authentication, and monitoring.

It can also be a useful way to sanity-check assumptions against established guidance such as NIST SP 800-53 Rev 5 Security and Privacy Controls, especially when the discussion is about what should be governed, measured, or reviewed rather than how to build a product feature.

What good outcomes look like

A good BoF does not need to produce a formal decision on the spot. Its success measure is often whether it clarifies the problem, identifies shared terminology, and creates enough consensus to support follow-up work such as a working group, a requirements draft, or a practitioner guide.

In security settings, the best sessions usually end with a sharper understanding of where the main risks, blockers, and control gaps actually sit. That may include an appreciation of whether the issue is technical, procedural, organisational, or a mix of all three.

Useful BoF sessions also leave behind a clear record of themes, open questions, and next steps. Without that follow-through, the discussion may be lively but still fail to turn practitioner insight into something actionable.

Related resources from NHI Mgmt Group

• What is the difference between IAM controls and session security?
• When does step-up authentication help inside a session?
• What is the difference between password theft and session theft?
• What is the difference between secret rotation and session governance?