When an Opus. 4.8 AI offensive agent was given the prompt to perform a red-team engagement in a lab environment that simulates a real enterprise, it reached full domain compromise in under seven minutes, without a single zero-day. It chained misconfigurations, over-privileged accounts, and forgotten service accounts into a complete kill chain, faster than any human defender could respond. In this session, we'll take you through a live AI. attack and walk through what we observed in our real, Glasswing customer environments: how these attacks moved, where they found footholds, and what actually stopped them. Attendees will leave with a clear picture of where AI-speed attacks land in the identity layer, why non-human identities are the primary target, and what runtime enforcement looks like in practice.

Demos of agentic AI keep looking better. The value in one case is obvious, and it’s easy to imagine it scales across everything. But the real test comes in the real world: when you need to respond to a live incident, when the data you try to run AI on isn’t perfect, or when something changes inside the model.  

This is when the harness comes in. It supplies the appropriate context, controls which data and tools may be accessed, applies permission and policy boundaries, validates output and proposed actions, manages execution, and records what occurred.  You will leave this session with a clear definition of the agent harness, and why it, not the model, decides whether agentic features work in production.

Identity, particularly within AD, Entra ID, and Okta environments, has become the primary control plane for modern organizations—and the single greatest threat vector for sophisticated cyberattacks. The data is alarming: 90% of organizations have experienced an identity-related incident in the past 12 months. This session will dissect the gap between legacy DR processes and the necessity for instant, secure identity resilience. It will focus on the complex, archaic, and often catastrophic process of traditional AD Forest Recovery. This manual process transforms an identity attack into a multi-day event for IT and Security teams, often resulting in operational downtime, business losses and reputational damage. Rubrik will highlight how to shift recovery of Tier 0 applications from days to minutes.

News headlines show you the breaches at massive corporations, but it’s everyday organizations that face the most threats. Adversaries prey on the human psyche and use AI to advance their tactics and target the companies that keep our communities running.  For these companies, a ransomware or BEC attack isn’t just a stressful event—it’s the reason they can’t make payroll. This session explores how hackers plan to win, and why you don’t need a massive budget to fight back.  We’ll get into how Huntress brings cyber resilience through a powerful combo of purpose-built technology and human SOC expertise to stop threats before they cause damage—because organizations of ALL sizes deserve a fighting chance against attackers.

Abstract
AI and new digital technologies will continue to shift the cybersecurity landscape in 2026. This session explores how modern tools can enhance detection, response, and decision making while introducing new risks tied to generative systems, data integrity, and fast moving threat innovation. Leaders will gain a clear view of how to adopt emerging technology in a responsible and strategic way that supports resilience and aligns with enterprise risk goals.

Key Takeaways
• How AI and emerging tech are reshaping core security functions
• The new risks created by generative models and evolving attack techniques
• Practical governance steps that support responsible AI use
• Examples of organizations pairing innovation with disciplined risk management

When disruption hits, which customer-facing services go down, and how fast does the business come back? Boards, auditors, COOs and customers now put that question to the CISO each quarter. Most security leaders have an answer ready. Few are confident in it.  Joe Ruck has spent most of his career in backup and recovery, on both the vendor and buyer side. In this session he breaks down why the resilience tools most enterprises already own (IaC automation, data protection, DR automation, posture dashboards, IaC governance) each solve a real problem and still leave the board's question unanswered. He shares the cascading failures those tools cannot see, the five capabilities end-to-end recovery requires, and the questions to bring to your next vendor evaluation.

AI is now both a weapon and a shield. TrendAI™ research shows malicious actors using large language models to do reconnaissance, craft convincing phishing lures, automate vulnerability research, and generate malware at scale, lowering the barrier for even less sophisticated threat groups. At the same time, defenders are using AI to correlate signals across massive attack surfaces, surface behavioral anomalies, and respond with a speed and precision that simply wasn't possible before. I'll share what we're seeing in active campaigns and how AI is fundamentally shifting the economics of defense in our favor

Abstract:
As organizations expand their digital ecosystems, risks extend far beyond internal networks. Threat actors are increasingly exploiting supply chains, third-party vendors, and identity gaps to gain access. This session brings together cybersecurity leaders and solution providers to explore how these interwoven risks create a complex attack surface -and how technology can help mitigate them.

Panelists will share real-world examples, lessons from managing large vendor networks, and innovative tools and frameworks for continuous risk assessment. Discussions will highlight strategies for mapping hidden dependencies, enforcing strong identity governance, and strengthening resilience through automation, collaboration, and transparency. Attendees will gain actionable insights on reducing exposure, improving third-party risk visibility, and leveraging technology to secure their extended digital ecosystem.

Key Takeaways:
• Understand how supply chains, vendors, and identities amplify organizational risk.
• Explore practical methods and tools for assessing, monitoring, and mitigating third-party and ecosystem vulnerabilities.
• Learn how to treat identity as a security perimeter using zero trust, access governance, and automated solutions.
• Gain insights from real-world breaches that reveal common gaps in vendor and identity controls.
• Walk away with a technology-informed framework to enhance resilience, secure partnerships, and reduce exposure across your digital ecosystem.

Cybersecurity leaders know the threats, but getting executives and boards to truly understand the business impact can be a different challenge. Join J.D. Miller for a fireside conversation with Karen Wendel, President and CEO of High Ridge Trust and TrustChains, exploring how CISOs and security leaders can communicate cyber risk in a way that resonates at the executive and board level. From translating technical threats into business impact to discussing risk, resilience, investment, and today’s rapidly changing threat climate, this conversation will examine what executives actually need from their security leaders and how better communication can lead to better decisions.

Torq surveyed 450 SOC leaders globally to find out what AI is actually doing inside the SOC. The findings challenged some assumptions — and confirmed others.  We’ll dig into insights including:   Why 97% of security leaders are confident AI can handle triage, but only 35% are using it there  What’s behind the trust barrier that 92% of leaders say is holding AI back  What 85% of leaders mean when they say they want a “unified platform”  Where teams plan to expand AI over the next 12 months — and what’s standing in their way

Adversaries no longer win through novel techniques; they win through agentic velocity. Today's threat actors use AI to chain standard attack paths autonomously at machine speed, rendering static indicators and quarterly detection cycles obsolete. Defensive failure is no longer a budget constraint, it is an architectural challenge driven by positioning detection downstream of data collection.    

To counter autonomous attacks, enterprises must deploy autonomous investigation architectures that synthesize entity context, evaluate blast radius, and deliver actionable briefs in seconds. Moving from reactive indicator tracking to stream-level behavioral correlation allows security leaders to outpace AI-driven threats without increasing operational overhead. This session outlines the four non-negotiable architectural shifts required to transform your detection stack from a passive logging sink into an active, machine-speed defense engine.

The perpetual resource and talent shortages have reigned over the cybersecurity industry and now impact AI adoption. According to the NCSR 2024 Report, 73% of State, Local, Tribal, and Territorial (SLTT) agencies cite funding shortages and 80% operate with under five security staff—driving 100% of surveyed municipalities to report an urgent need for Information Security Analysts amid rising AI threats. This session summarizes a few successful examples of solving these challenges in local governments and smaller businesses, including the GovAI Coalition’s Certified Civic AI Professional (CAIP) program for its 1,000 member agencies and a startup company’s SOC 2 audit readiness.

Key Takeaways for Attendees

• Resource Augmentation via Collaboration: How the GovAI Coalition launched the CAIP credential with an existing two-person core team by leveraging partner networks, fellows, and university interns.
• Cost-Effective GRC Compliance: How a startup prepared for a SOC 2 audit using open-source GRC tools to save $3,500 annually.
• Streamlined Public Sector Procurement: How California agencies can leverage California Public Contract Code §10299 piggybacking mechanisms to adopt proven cybersecurity master agreements through 2030.

Abstract:
Cybersecurity challenges are complex, and solving them requires teams with diverse perspectives, skills, and experiences. This panel explores how diversity drives better problem-solving, innovation, and threat detection in security organizations.

Panelists will share strategies for attracting and retaining talent from varied backgrounds, leveraging unique thinking styles, and applying different experiences to uncover blind spots in risk management. Attendees will gain actionable insights for building teams that are not only technically skilled but more adaptive, creative, and resilient in the face of evolving cyber threats.

Key Takeaways:

• Understand how diversity strengthens problem-solving, innovation, and threat response.
• Learn approaches to recruit and retain talent from non-traditional backgrounds.
• Explore how different perspectives and thinking styles reveal hidden risks.
• Gain strategies to create teams that are adaptable, collaborative, and resilient.
• Walk away with practical ideas for integrating diversity into cybersecurity team design and strategy.

Modern adversaries no longer need to exploit software vulnerabilities; they simply log in. As automation scales, AI agents are aggressively hunting high-privilege non-human identities (NHIs) to quietly manipulate Identity Providers, escalate privileges, and stand up legitimate-looking shadow accounts. Identity is now the ultimate front gate, and when it is compromised, the entire recovery process stalls.  Detection is only half the battle. If incident response teams blindly restore a prior version of their environment without understanding exactly what was touched, they risk re-initiating the attack loop by reviving hidden backdoors, shadow admin roles, and altered access policies.  In this session, we will explore the critical gap between threat detection and trusted recovery. Attendees will learn how AI-powered relationship graphs map attacker behaviors directly to MITRE ATT&CK frameworks, turning raw logs into an actionable evidence trail. We will walk through how to abandon trial-and-error manual investigations in favor of surgical, object-level rollbacks, arming you with a clear blueprint to purge persistent threats and restore your identity environment to a verifiably clean state.

Every AI assistant, coding agent, and notetaker bot enters the same way: an employee clicks "Allow" on an OAuth consent screen. That decision takes <10 seconds but the access it grants lasts forever. This session shares findings from an analysis of 22,332 OAuth-connected applications across 21 enterprise Google Workspace environments: 91% of AI apps appeared in just 16 months, 47% of all apps sit dormant with access intact, and 1,064 apps hold live tokens for users who are no longer there, including 463 with sensitive or restricted scopes. Why this matters: stolen tokens bypass every control built for credential theft. Attendees leave with three concrete actions to find and govern the trust decisions their organization has already made.

AI agents have adopted a range of security tasks. Across SOCs a question is being asked: how do we design autonomy acceptable to our security engineering principles? Or more simply, when should we be in vs on the loop with agents?  This talk proposes a framework to approach this challenge. A method that takes into mind design and dynamism of impact criticality and context. When an attack spreads toward critical systems, the blast radius grows, and the human moves closer to the action. As the AI earns trust, the human can move up the loop to focus on validation and tuning.

Cars didn't reach self-driving by perfecting cruise control; autonomy required a platform shift. Security operations faces the same moment. Most enterprises remain stuck with SIEM, SOAR, and MDR tools that speed up triage but stay blind beyond the known world, while adversaries already use AI to run attacks almost entirely autonomously and uncover long-hidden vulnerabilities at scale.  In this session, Netenrich CISO Christopher Morales argues that defenders must move from the "efficiency game" of human-speed incident management to the "efficacy game" of data-driven security operations that prevents incidents. He outlines what this shift practically requires (a living data foundation, risk scored by business impact, and governed agents working alongside humans) and traces the path from Agentic SOC to Autonomous SecOps - showing how Netenrich changes what CTOs, CIOs, and CISOs can tell the board about risk.