“One of the ways I stay relevant in the world of digital identity is by going to a lot of conferences and events.”

It is, more or less, in my job description as a consultant. I need to know what people are building, what organizations are struggling with, what standards are beginning to matter, what vendors are selling, and what practitioners are actually worried about when you get them away from the microphones. And, most importantly, I need relationships with the people doing all these things.

That said, I am also acutely aware that not everyone can spend quite as much of their life in conference centers and airports as I do. Budgets are a thing.

There are ways to make conference attendance somewhat less painful financially. Being accepted as a speaker will often get you a complimentary conference pass, although travel and accommodations are another matter entirely. Programs such as the Kim Cameron Award and Vittorio Bertocci Award can also help people who would otherwise have difficulty participating in industry events.

But you shouldn’t have to become a conference speaker just to justify attending a conference. Going as an attendee is valuable in its own right. A good event can help you understand technologies your organization is about to be asked to implement, expose you to problems you haven’t encountered yet, and introduce you to people working through exactly the same things you are.

That last part is easy to underestimate. Your professional network is useful when you need an expert opinion, when you’re trying to figure out whether everyone else is having the same implementation problem, when you’re looking for your next job, or when you’re trying to hire someone for yours.

The problem is figuring out which conference is worth the time and money. There are a LOT of them.

You can Subscribe and Listen to the Podcast on Apple Podcasts, or wherever you listen to Podcasts.

And be sure to leave me a Rating and Review!

The short version

If you have approval for one conference and just want to know where to start, this is my shorthand:

If you want to…	Look at…
Understand the broader cybersecurity world around identity	RSAC
Get the broadest picture of enterprise identity today	Identiverse
Understand identity through a European policy and market lens	EIC
Understand African identity priorities and challenge developed-market assumptions	ID4Africa
Explore ideas before they become mainstream technologies	IIW
Go deeper on authentication and technologies likely to shape the next few years	Authenticate
Think about identity architecture five or more years out	The Identity Salon

That is not a ranking. These events have different centers of gravity, different communities, and different reasons for existing, which is why choosing one based on reputation alone is a mistake.

What counts as an “anchor event”?

I maintain a list of identity and identity-adjacent conferences in GitHub, although I may eventually move it to my website.

I have some rules for what goes on that list. I am primarily interested in multi-day industry events rather than one-day meetings, and I do not include conferences whose primary purpose is promoting one company’s products and ecosystem. That means you won’t find Oktane, AWS re:Invent, BlinkOn, Fal.Con, and similar vendor events there. Those events can be entirely worthwhile; they’re just a different category.

For this post, I am narrowing the list even further.

I think of the conferences below as anchor events: gatherings that either bring together a substantial part of an identity community or provide a perspective that is difficult to replicate elsewhere.

This is not meant to be a comprehensive conference calendar, and omission from this list is not a judgment that another event is bad. Regional conferences, government meetings, academic events, standards meetings, and specialist gatherings can be much more valuable depending on what you need.

A note before we get into the individual events: some of the links below include discount or referral codes where I have them. Nobody has paid me to include an event in this post. Where a link provides a discount or is a referral link, I will say so. I also intend to keep this post updated as dates, locations, discounts, and my own views change.

So: how do you choose?

RSAC: when you need to understand the security world around identity

Let’s start with the obvious caveat: RSAC is not an identity conference. It is an enormous cybersecurity conference. That is exactly why it can be useful.

If you attend RSAC expecting several days of deep identity content, you will be disappointed. Identity is one part of a much larger program, and the sheer scale of the event can make it difficult to find the signal you want.

But identity does not exist in isolation from cybersecurity.

If your work involves identity security, fraud, enterprise security architecture, threat intelligence, AI security, security operations, or any of the many places where identity and cybersecurity collide, periodically getting outside the identity bubble is valuable.

It is also where an astonishing amount of the security industry goes to meet, network, compare notes, gossip, and try to figure out what everyone else thinks is going to happen next. A 40,000-person event is a wild experience.

Go to RSAC if: you want to understand the larger cybersecurity environment in which identity systems operate.

You may want to skip it if: what you really need is three days of concentrated IAM architecture, standards, or identity implementation content. There are better places to spend that budget.

How often? For an identity practitioner, probably not every year unless security is a major part of your role. But it is worth going periodically.

Identiverse: when you need to know what’s happening in identity now

Identiverse is currently the largest conference focused specifically on digital identity and digital trust.

This is the event I would point someone toward if they said:

I work in identity. I have budget for one big conference. Where should I go?

Identiverse covers a wide range of the field, from authentication and authorization through identity security, architecture, privacy, fraud, standards, governance, workforce identity, customer identity, AI, and whatever new problem has appeared since the previous year’s conference.

Its center of gravity is relatively close to implementation.

That does not mean there is no speculation about the future; there is. But a significant amount of the program deals with problems enterprises are working on now or are likely to encounter over the next few years.

That makes it particularly useful for practitioners who need to go home and do something with what they have learned.

If you want to speak, the Call for Presentations for 2027 is expected to open later this year.

Go to Identiverse if: you want the broadest view of what enterprise digital identity practitioners are implementing, buying, designing, worrying about, or preparing for over roughly the next one to three years.

You may want to skip it if: your interests are extremely narrow and you would get more value from a specialist event, standards meeting, or workshop devoted to that particular problem.

I have a registration code that provides 30% off Identiverse 2027 Early Bird rates: IDV27-Heather.

EIC: when you need the European view of identity

The European Identity & Cloud Conference, or EIC, is one of the anchor points of the European identity community.

There is plenty of technical content, but one reason I continue to find EIC useful is that it provides a different lens on identity from the big US events. European regulation, digital identity policy, privacy, digital wallets, sovereignty, governance, and the relationship between government and industry naturally play a larger role.

We sometimes talk about “the identity industry” as though it were one homogeneous global ecosystem. It very much isn’t. Technologies travel across borders much more easily than regulatory assumptions, cultural expectations, government infrastructure, and business models do.

EIC is one of the places where those differences become particularly visible.

I have been to EIC many times and expect to continue going. I will also warn first-time attendees that I find it one of the more physically demanding conferences I attend. The main days are long. Really, really long. Sessions are often grouped into dense blocks, and the keynote program can run for hours.

You will learn things. You may also need a nap.

Go to EIC if: you work in Europe, sell into Europe, need to understand European digital identity policy and regulation, or want an identity conference whose assumptions are not primarily shaped by the US market.

You may want to skip it if: the European regulatory and policy environment has very little bearing on your work and what you really need is a more narrowly implementation-focused program.

For EIC 2027, code eic27heatherf provides a 15% registration discount through the EIC registration site.

ID4Africa: when you need your assumptions challenged

I haven’t attended ID4Africa yet, so this recommendation comes with that important qualification. I am including it anyway because I think it belongs in any serious discussion of global identity conferences.

Just as EIC reflects European priorities, ID4Africa focuses on what identity systems need to accomplish across African countries. Those requirements can expose assumptions that practitioners in North America and Europe do not even realize they are making.

What happens when civil registration or foundational identity coverage is incomplete? How should identity systems work across populations with very different levels of access to government documentation, connectivity, devices, financial services, and digital infrastructure? What does inclusion actually require when you cannot assume that all of the prerequisites for enrollment already exist?

Those aren’t niche questions. They’re fundamental identity questions.

They are also a useful reminder that solutions developed in highly digitized economies are not automatically universal solutions.

I don’t know yet when or where the 2027 event will be held, but this is one to watch.

Go to ID4Africa if: you work on national-scale identity, identity for development, government identity infrastructure, financial inclusion, or simply need to understand identity requirements outside the North American and European environments.

You may want to skip it if: your work is tightly constrained to enterprise IAM in markets where national identity infrastructure and inclusion questions have little practical effect on your responsibilities.

IIW: when you want to help figure out what comes next

The Internet Identity Workshop is nothing like the conferences above. That’s intentional.

IIW is an Open Space unconference, which means there is no predetermined conference program full of speakers delivering presentations. Participants arrive, propose sessions, construct the agenda together, and then go work on whatever problems they think need solving. Attendance is deliberately limited, which makes the experience very different from a large industry conference.

If Identiverse or EIC is where you might hear about something companies are beginning to implement, IIW is quite often where you will encounter ideas before they have reached that point. Sometimes considerably before.

Protocols, architectures, terminology, governance models, half-formed ideas, new use cases, and arguments about all of the above can show up here.

But IIW does not neatly fit into a particular time horizon. Some discussions are speculative. Others involve technologies people are already deploying. Its real distinguishing characteristic is that the people attending are there to work on the ideas rather than simply hear about them.

The important word is participation.

You can certainly attend IIW and listen, particularly your first time, but you will get much more out of it if you arrive prepared to ask questions, propose sessions, challenge assumptions, and contribute.

Go to IIW if: you want to participate in figuring out what identity might look like next, rather than primarily learning about what organizations are deploying today.

You may want to skip it if: you want a predetermined curriculum, polished presentations, or a conference where you can sit quietly in the back and absorb a carefully curated program.

Authenticate: when authentication is central, but you want to see what comes next

Authenticate is organized by the FIDO Alliance, so yes, you are going to hear about passkeys. Quite a lot, in fact. But describing Authenticate purely as “the passkey conference” increasingly understates what is happening there.

The program extends into authentication, identity verification, account recovery, authorization, fraud, payments, agentic systems, and other problems that appear when we start asking what comes after widespread deployment of phishing-resistant authentication.

I tend to think of Authenticate as having a somewhat different center of gravity from Identiverse. Some technologies discussed there are already being deployed at scale, while others are still working their way toward broader adoption. For my purposes, that often makes it useful for thinking about the three-to-five-year range.

Again, that is a center of gravity rather than a hard boundary.

Go to Authenticate if: authentication is a significant part of your job, or you want a more focused look at technologies that may shape identity implementation over the next several years.

You may want to skip it if: authentication and adjacent technologies are only a small part of what you need to understand, and you would benefit more from a broader identity program.

I don’t have a registration discount for Authenticate 2026, but if you’re registering, I’d appreciate it if you use my referral link.

And a shout-out to The Identity Salon

I am going to abuse my own rules slightly here because The Identity Salon isn’t really an event.

Events are part of what we do, but the Salon is intended to support a continuing conversation rather than produce one large annual gathering. I’ve written about the project before, so I won’t repeat the entire explanation here. I am including it because it fills another point on the spectrum.

If Identiverse, EIC, and ID4Africa tend to spend much of their time on today’s problems and the next few years of implementation, and Authenticate often reaches somewhat farther into what may be coming next, The Identity Salon deliberately looks farther out.

The conversations are about the problems we think identity architects and organizations may be confronting five or more years from now, before vendors have product categories for them, and often before the industry has even settled on useful terminology.

IIW also spends plenty of time on the long term, but it plays a different role. IIW creates a place to explore and develop ideas. The Salon is specifically about getting experienced practitioners to think through the long-term implications of those ideas for identity systems and organizations.

Look at The Identity Salon if: your job requires you to think beyond the next product cycle and start considering the identity architecture your organization may need five to seven years from now. Being invited to an event or not, subscribers still get a report from the discussions that they can use as a reference.

It probably isn’t what you want if: you are primarily looking for a conventional conference experience with dozens of presentations, a large expo floor, and a broad menu of topics.

Don’t automatically fly across the world

There is another important constraint on all of this advice: geography. The biggest or best-known conference is not automatically the right conference for you.

A practitioner based in Singapore may get more value from Authenticate APAC than from flying to California. Someone working primarily with European governments may get vastly more from EIC than from an event in Las Vegas. A strong regional conference where the people you actually need to meet will be in the room can beat a flagship event that requires a long flight and a much larger budget.

Travel cost, time away from work, and accessibility all count when deciding whether an event is “worth it.” That is one reason I maintain the larger conference list. These anchor events are useful reference points, but they are not the only good choices.

So which conference should you attend?

My answer is frustratingly consultant-like: It depends on what problem you’re trying to solve.

• If you need to catch up on the broad identity market, Identiverse is probably the obvious starting point.
• If you need to understand how identity fits into the larger security industry, go to RSAC.
• If European policy and regulation shape your work, EIC belongs on your list.
• If you work on identity at national scale, or need your assumptions about foundational identity challenged, pay attention to ID4Africa.
• If you want to participate in shaping ideas before they become polished conference presentations, go to IIW.
• If authentication is central to your work and you want to understand what may be coming next, Authenticate is a particularly useful place to spend your time.
• And if your job is to worry about what identity architecture needs to look like five or more years from now, that is exactly the sort of conversation we are trying to have at The Identity Salon.

There are excellent events that aren’t on this list in this blog, though hopefully they are in that list on GitHub. There are also years when you may decide that none of these are worth the money, because a smaller regional event or specialist meeting better matches what you need.

The key is to choose based on the problem you are trying to solve, rather than simply going to whatever conference everyone else seems to be attending.

Why going still matters

Every budget conversation about conferences eventually produces some variation of:

Couldn’t you just watch the recordings?

Recordings can give you the presentations. They cannot give you the conversation over coffee when someone tells you about the deployment problem they didn’t put on the slide. They don’t introduce you to the person who will answer your weird standards question six months later. They don’t let you notice that five completely unrelated organizations are struggling with the same problem.

And they don’t build the human network that, for all our enthusiasm about digital identity, still holds a remarkable amount of this industry together. That is ultimately why I keep going.

Choose your adventure accordingly.

📩 Want to stay updated? I write about digital identity and related standards—because someone has to keep track of all this! Subscribe to get a notification when new blog posts go live. No spam, just announcements of new posts. [Subscribe here] 

Transcript

One of the ways I stay relevant in the world of digital identity is by going to a lot of conferences, events, and meetings around the world.

It is, more or less, in my job description.

As a consultant, I need to know:

• What people are building
• Who is doing that building
• What organizations are struggling with
• Which standards are beginning to matter
• What vendors are selling

And yes, that means I spend a somewhat ridiculous amount of time in conference centers, hotel ballrooms, airports, and lines for coffee.

However, I’m also acutely aware that not everyone can do that.

Budgets are a thing.

Travel policies are a thing.

Time away from work and family is a thing.

Even if your employer is willing to pay for one conference a year, there is still a practical question:

Which conference is actually worth your time and money?

---

Why Identity Conferences Still Matter

There are ways to make conference attendance a little less painful financially.

Being accepted as a speaker will often get you a complimentary conference pass, although travel and accommodations are usually still your problem.

There are also programs such as the Kim Cameron Award and the Vittorio Bertocci Award that can help people who might otherwise struggle to attend.

But not everyone wants to speak at a conference.

And that’s entirely fine.

Attending is valuable in its own right.

A good event can help you understand technologies your organization is about to be asked to implement.

It can expose you to problems you haven’t encountered yet.

It can also help you hear how other organizations are dealing with the same messy operational questions that you are.

And then there is the human network.

That’s incredibly easy to underestimate.

Your network can be useful when you:

• Need an expert opinion on something obscure
• Want to know whether other organizations are experiencing the same deployment problem
• Are hiring
• Are job hunting
• Suddenly remember that someone you met over coffee knows exactly who you need to talk to

Recordings don’t do that particularly well.

So yes, conferences still matter.

---

There Is No Single Best Identity Conference

The harder question, of course, is which conference?

There are a lot of them.

I maintain a list of identity and identity-adjacent conferences on GitHub, although I may eventually move that to my website.

I have some rules about what goes on the list.

I’m mostly interested in multi-day industry events.

I don’t include conferences whose primary purpose is promoting a single company’s products and ecosystem.

Those events may be extremely useful if you’re deeply embedded in those ecosystems.

They’re simply a different category from what I’m talking about here.

For this guide, I’ve narrowed the list further.

I’m focusing on what I think of as the anchor events around digital identity.

These are conferences that either:

• Bring together a substantial part of an identity community
• Provide a perspective that is difficult to replicate elsewhere

These events are not interchangeable.

There is no single best identity conference.

There is only the conference that is most useful for the problem you are personally trying to solve.

---

The Short List

Here’s the short version.

If you want to understand the broader cybersecurity world that impacts identity, look to RSA Conference.

If you want the broadest picture of enterprise identity today, look to Identiverse.

If you need the European perspective on identity regulation and policy, look to EIC.

If you need your assumptions about identity challenged by very different infrastructure and inclusion requirements, pay attention to ID4Africa.

If you want to participate in shaping ideas before they become mainstream implementations, go to Internet Identity Workshop, also known as IIW.

If authentication is central to your job and you want to see where part of the industry is heading, look to Authenticate.

And, last but not least, if your job requires you to think about identity architecture five or more years out, that’s where the Identity Salon fits.

Now, let me sort through those options.

---

RSA Conference

RSA is the odd one out on this list because it isn’t actually an identity conference.

It’s a cybersecurity conference.

And it’s huge.

With tens of thousands of people attending, you should not expect several days of concentrated identity and access management content.

Identity is simply one part of a much larger security program.

However, identity doesn’t exist in isolation from security.

Sometimes it is useful to get outside our own bubble.

If your work touches:

• Identity
• Security
• Fraud
• Enterprise security architecture
• Threat intelligence
• Security operations
• AI security

RSA can be extremely useful.

It’s where a remarkable number of security practitioners go to meet, compare notes, and try to figure out what everyone else thinks is about to happen.

Would I recommend it every year for every identity practitioner?

Nope.

Not even a little bit.

But periodically?

Absolutely.

---

Identiverse

For the identity audience, Identiverse is a much more obvious choice.

If someone came to me and said:

“I work in identity. I have the budget for one major conference, and I want the broadest possible view of what’s happening in the industry today.”

Identiverse would probably be my starting point.

Its strength is the breadth of what it covers.

You’ll find conversations about:

• Authentication
• Authorization
• Security architecture
• Privacy
• Fraud
• Governance

The other important factor is timing.

Much of what is discussed is relatively close to implementation.

There is certainly future-looking content, but a lot of the material focuses on what enterprises are working on now or are likely to deal with over the next one to three years.

So if your job requires you to go home after the conference and actually do something with what you learned, Identiverse is very useful.

---

EIC

EIC, the European Identity and Cloud Conference, plays a different role.

It provides a much stronger European lens on identity.

That specificity matters more than you might think.

We often talk about the identity industry as though it were one coherent global ecosystem.

It really isn’t.

Technology crosses borders relatively easily.

Regulatory assumptions do not.

Cultural expectations do not.

Government infrastructure does not.

Business models probably don’t either.

At EIC, European regulation, digital wallets, privacy, sovereignty, governance, and the relationship between government and industry are much more central to the conversation.

So if your work touches Europe, EIC is incredibly valuable.

I have been to many EIC events, and I expect to keep going.

I will also say that I find it one of the more physically demanding conferences I attend.

The days are very long.

The sessions are very dense.

The keynote slots can run for hours.

You’re going to learn things.

But you may also want a nap.

---

ID4Africa

ID4Africa is the one conference on this list that I have not personally attended, so I want to be explicit about that.

I’m including it because I think any serious discussion of global digital identity should include it.

Just as EIC reflects European priorities, ID4Africa focuses on identity requirements across African countries.

That matters because it forces us to confront assumptions that practitioners in North America and Europe may not even realize they are making.

For example:

• What happens when civil registration coverage is incomplete?
• What happens when access to documentation varies?
• What happens when connectivity isn’t universal?
• What happens when smartphones aren’t universally available?
• What does inclusion mean when the infrastructure we casually assume exists simply doesn’t?

Those aren’t side questions.

They are core identity questions in the region.

And they provide a useful corrective to the idea that systems designed in wealthy, highly digitized economies are automatically suitable everywhere else.

---

Internet Identity Workshop

IIW, the Internet Identity Workshop, is fundamentally different from everything else on this list.

It is an open-space conference.

That means there isn’t a pre-built agenda full of polished talks.

The people who show up create the agenda together.

As a result, you can find yourself in conversations about:

• Protocols
• Architectures
• Governance models
• Terminology
• Emerging ideas

And those conversations may still be evolving.

Its defining characteristic is participation.

You can certainly go and listen.

Especially if it is your first time, that’s probably what you should do initially.

But you’re going to get far more out of IIW if you’re willing to:

• Propose sessions
• Ask questions
• Challenge assumptions
• Contribute

I wouldn’t put IIW on a one-to-five-year technology timeline.

It spans everything from highly speculative ideas to things people are already deploying.

What makes it distinctive is that people are there to work on ideas, not simply hear about them.

---

Authenticate

That brings us to Authenticate.

Authenticate is organized by the FIDO Alliance.

Yes, there will be a lot of conversation about passkeys.

A lot.

But it has grown beyond simply being the passkey conference.

The program increasingly touches:

• Authentication
• Identity verification
• Account recovery
• Authorization
• Fraud
• Payments
• Problems that emerge as phishing-resistant authentication becomes more widely deployed

I tend to think of Authenticate as particularly useful for practitioners who want to go deeper on authentication and adjacent technologies.

It also occupies an interesting timeframe.

I see it as particularly useful for thinking about the next three to five years.

That’s a range that otherwise doesn’t have a conference focusing on it in quite the same way.

---

Identity Salon

And then there’s the Identity Salon.

I’m admitting that I’m cheating slightly by including it because it isn’t a conference at all.

We do hold events, but the Salon is intended to support ongoing conversation rather than one large annual gathering.

I include it because it occupies a different point on the spectrum of time and information.

The Salon is deliberately focused much farther out.

We’re interested in the problems identity architects and organizations may be facing five or more years from now.

That means thinking about problems before there is necessarily:

• A product category
• A clear answer in the standards space
• A universally agreed term

IIW can absolutely reach that far out, too.

However, it plays a different role.

IIW is a place where ideas are explored and developed.

The Salon is more focused on what those ideas could mean for future identity systems and enterprise architecture.

---

Geography Matters

There’s one other point I want to make.

It’s easy to become seduced by flagship conferences.

But famous events don’t automatically become more valuable simply because you’re willing to fly across the world to attend them.

Geography matters.

Travel costs matter.

Time away from work and family matters.

Sometimes a smaller regional event, where the people you actually need to meet are present, is much more valuable than a giant international conference.

The biggest event is not automatically the correct event.

The best event is the one that helps you solve the problem you actually have.

---

Choose the Conference That Matches Your Goal

That’s really the point of this whole guide.

Don’t ask:

What’s the best identity conference?

Instead, ask yourself:

• What am I trying to learn?
• What community do I need access to?
• What assumptions do I need challenged?
• How far out am I trying to think?

Those questions will usually lead you to a better answer.

And yes, somebody will eventually ask during the budget conversation whether you could just watch the recordings.

Sure.

You can.

But recordings will give you the presentations.

They won’t give you the coffee conversation.

---

Why Recordings Aren’t the Same

A recording won’t tell you the deployment problem someone left off the slide because it was slightly too politically sensitive.

It won’t introduce you to the person who answers your standards question six months later.

It won’t necessarily help you notice that five completely unrelated organizations are quietly struggling with the same issue because they’re all asking questions in the same room.

And recordings don’t help build the human network that still holds a surprising amount of this industry together.

That human element is ultimately why I keep going.

So, as you think about conference attendance, choose your event accordingly.

---

Final Thoughts

There isn’t one perfect identity conference.

Different events serve different purposes.

Some are better for understanding current enterprise identity.

Others provide regional or global perspectives.

Some focus on authentication.

Others encourage open exploration of emerging ideas.

And some are deliberately looking much farther into the future.

The right choice depends on what you need from the experience.

Consider:

• Your professional goals
• Your technical focus
• Your geographic priorities
• Your planning horizon
• The community you need to reach
• Your available budget and time

Then choose accordingly.

Several of these events have links and, in some cases, discount codes available in the written version of this post.

And otherwise, I really hope to see you at one of these events in the next year or so.

---

Conclusion

Conferences remain one of the best ways to understand not only what is happening in digital identity, but who is making it happen.

However, attending every conference isn’t realistic.

It isn’t necessary, either.

The goal is to choose strategically.

Go where you can learn something you need to know.

Go where your assumptions will be challenged.

Go where the people and conversations can help you solve the problems you’re actually facing.

Because the best identity conference isn’t necessarily the biggest, newest, or most prestigious.

It’s the one that gives you the context, connections, and perspective you need right now.

---