Least privilege, impossible?!

Everyone agrees with the principle of least privilege — in theory. But in practice? It’s often misunderstood, inconsistently applied, and quietly ignored.

This session pulls back the curtain on why least privilege remains so elusive in modern enterprises, despite being one of the most well-known cyber hygiene principles. Through real-world examples and observations from the field, we’ll explore why excessive access continues to fly under the radar, how privilege creep accumulates silently over time, and what actually happens when auditing and compliance mechanisms fail to catch it.

The talk will start by examining the root causes behind least privilege breakdowns: organisational complexity, unclear ownership, outdated processes, and human nature. We’ll walk through how identity sprawl — especially non-human access — compounds these issues, making it almost impossible to answer the deceptively simple questions: “Who has access to what?” and “Should they have that access?”

From there, we’ll spotlight several common access pitfalls, including:

This is not a technology pitch — it's a practical, systems-level look at why the principle of least privilege struggles to take hold, even in mature security programs. We’ll explore the interplay between identity governance, automation, and organisational behaviour — including where well-meaning initiatives go wrong.

The session closes with a hopeful message: least privilege is achievable — but only when it’s embedded as a culture, not just enforced as a control. Attendees will walk away with a clearer understanding of:

This talk is ideal for cyber leaders, risk and compliance teams, and identity professionals looking to go beyond surface-level understanding and drive real-world change.