Privileged Access Management: When audit confidence and operational reality diverge

Most organisations have Privileged Access Management deployed, audited, and signed off. Many have no reliable way of knowing whether it is actually working, and fewer still have mapped the full scope of privilege that actually exists across their environment. PAM is commonly treated as an installation event. The threat actor operating in your environment has already worked out what is in scope and what is not.

This session is a practitioner's guide to starting that conversation internally. It begins with a question most organisations have not formally answered: where does privilege actually sit across your environment? The conversation deliberately extends beyond human accounts to the non-person entities that now represent a material and growing share of privileged access.

This presentation will walk through:

1. Where privilege actually lives in a modern enterprise: a structured look at human and non-person privileged identities, including secrets, service accounts, API keys, certificates and agentic processes that most PAM capabilities were not designed to manage.
2. Where to look for coverage failures: privileged accounts and pathways existing entirely outside your PAM solution, with particular attention to non-person entities that are frequently ungoverned and untracked.
3. Where to look for deliberate process circumvention: why administrators bypass documented PAM workflows, what organisational conditions drive that behaviour, and what it tells you about whether your controls are operationally viable or simply theoretically sound.
4. Where to look for observability blind spots: privileged activity occurring without trace in your PAM tooling, with homework to take back to your team to test whether your detection capability is up to the job.
5. A set of practical discovery questions , concrete enough for you to begin the internal conversations in your organisation when you get back to the office.

By the end of this session you will know where to start looking, what to ask, and how to tell the difference between a PAM capability that is genuinely working and one that is not delivering the control outcomes your organisation requires.