Insights from DTX Manchester 2026
Organisations are being asked to modernise services, respond to changing expectations and strengthen resilience, while the environments those services sit within are becoming more complex.
Now more than ever, that complexity shows up in the way services are built and used. Systems are more connected, delivery involves more teams and people are accessing services across different devices, locations and routes. At the same time, risk is changing too, particularly where identity, access management and cyber security meet.
DTX Manchester provided a forum for conversation about those pressures. Across the two days, many of the conversations were less about technology in isolation and more about how cyber can be integrated into digital transformation strategy.
Key themes at the event
Across the event, a number of conversations came back to similar themes, with a recurring focus on how organisations can keep enhancing services while still managing risk, trust and complexity, such as:
- The pressure to modernise services without adding more complexity
- The changing role identity plays in how people continue to access and experience services
- Cyber security becoming more closely connected to user behaviour and service design
- The need to manage risk without creating unnecessary friction
Hippo’s main stage session sat naturally within that wider conversation. James Odom, Jim Small and Pelin Demir explored such themes in their talk ‘Secure the person, not the perimeter’, looking at how cyber security, identity and user-centred design need to work together so that services are built around people rather than fixed boundaries.
Securing the person, not the perimeter
The Hippo team’s session focused on a shift that many organisations are already grappling with. For a long time, cyber security was often understood through the idea of a perimeter. There was a boundary to defend, a network to protect and a clearer distinction between who was inside and who was outside.
That picture is harder to apply to modern services. Services are often run across cloud platforms, supported by distributed teams and connected to suppliers, partners or third party tools. People also move between devices, locations and access points throughout the day, which means risk is not only about whether a perimeter has been compromised. Security strategies now need to consider who is accessing a service, what they are trying to do, what level of access they have and whether that activity still looks appropriate in context.
It has to look at who the person is, what they are trying to do, what level of confidence is needed and what risk is attached to that moment.
Customer experience: Where identity and security meet
Identity is often discussed through the language of authentication, access and assurance. Cyber security is likewise discussed through the language of monitoring, resilience and threat response. In practice, those areas now meet in the same place: how a customer experiences a digital service.
A login journey, an identity check, an access restriction or an additional verification step can all affect whether someone is able to complete what they came to do. They also affect how much confidence an organisation has in the person using the service and whether teams can spot when something does not look right.
That makes security a design issue as much as a technical one. If a security step is confusing, people may need more help to complete the journey, increasing support queries and adding pressure to the teams running the service. A journey with too much friction can push people towards workarounds. A weak view of identity can make monitoring harder. A lack of shared ownership can slow down response when something goes wrong.
| Topic | What teams often focus on | What matters in practice |
|---|---|---|
| Authentication | Technology and identity verification methods | Whether the right person can access the right service at the right time |
| Security controls | Technical implementation and policy compliance | Whether controls are clear, proportionate and usable |
| Monitoring | The volume of alerts and technical logs | Whether teams have enough context to understand risk |
| Access decisions | Binary "yes/no" permissions | Whether confidence matches the sensitivity of the action |
| Service design | Feature sets and technical requirements | Whether people can follow the safest route without unnecessary effort |
That is where human-centred security becomes useful. Some moments in a service need extra care, especially when the action carries more risk or the consequences of a mistake are higher. The important thing is that those checks feel proportionate, understandable and connected to what the person is trying to do, rather than appearing as another unexplained hurdle in the journey.
What the conversations around DTX showed
The conversations around DTX showed how widely these questions are being felt. At our stand and between sessions, people were talking about modernisation, cyber resilience, digital trust, organisational readiness and the realities of changing services that already carry operational pressure.
The emphasis changed depending on the organisation, but the underlying challenge was often similar. Teams are trying to improve services while managing older systems, changing expectations and increasing risk. They are looking for ways to move forward without losing sight of the people using the service or the teams responsible for running it.
That is where the main stage session connected with the wider event. ‘Securing the person, not the perimeter’ is a cyber security message, but it also speaks to a broader delivery challenge. It asks organisations to think about what happens when trust, access and usability are designed separately, and what becomes possible when they are considered together earlier as part of the same system.
What this kind of delivery depends on
Designing secure services around people depends on more than choosing the right tool or adding another control. It depends on how well teams understand the relationship between the person, the service and the risk involved.
That means looking at questions such as:
- Where identity decisions sit within the wider security model
- How access, monitoring and incident response share context
- Whether higher risk actions receive proportionate checks
- Where friction protects users and where it creates avoidable effort
- Whether security considerations are brought into service design and customer experience early enough
- How ownership works when identity related risk becomes a cyber issue
These questions can be difficult to work through because they rarely sit neatly with one team. They move between design, engineering, operations and security, and the gaps between those areas are often where services become harder to run or harder to use.
Bringing these considerations together earlier gives teams a better chance of understanding where a journey needs to be simpler, where stronger assurance is needed and where monitoring needs more context to support useful decisions.
Where this leaves secure digital services
Taken together, the conversations at DTX Manchester pointed to how closely cyber security, identity, service design and delivery now sit alongside one another. They are often felt at the same point in the life of a service, especially when someone is trying to access support, complete a task or prove who they are.
Good security does not sit outside the user experience. It shapes it. The opportunity is to design those moments with enough care that people can move through services with confidence, while organisations have the clarity they need to manage risk in practice.
