As organizations accelerate AI adoption, security leaders in highly regulated industries face a unique challenge: balancing innovation with stringent compliance, privacy, and risk management requirements. In this fireside discussion, Raja Mikkili, Head of Core Technology and Security at Arcutis Biotherapeutics, will explore how regulatory obligations reshape traditional approaches to AI security, governance, and vendor risk management.

The conversation will examine a rapidly emerging blind spot in enterprise AI deployments—the proliferation of non-human identities, including AI agents, service accounts, machine credentials, and autonomous systems that often operate outside established governance frameworks. While organizations have matured controls around human access and identity management, many remain unprepared to manage the scale, complexity, and security implications of machine-driven identities embedded within AI ecosystems.

Drawing from the realities of the biopharmaceutical sector, Raja will discuss how security teams can evaluate AI vendors, establish governance guardrails, address compliance requirements, and build trust in AI-enabled environments. Attendees will gain practical insights into identifying hidden risks, strengthening identity governance, and developing security strategies that support innovation without compromising regulatory responsibilities.

As organizations shift from chatbots to autonomous AI, security must evolve beyond user prompts. The adoption of the Model Context Protocol (MCP) communication allows autonomous agents to independently trigger backend APIs and execute high-risk business workflows. This creates a critical "Agentic Security Gap"—a massive attack surface that legacy defenses and LLM guardrails cannot protect. This session outlines a modern security architecture to govern goal-oriented autonomous systems. We will explore how to combat data exfiltration and business-logic attacks by applying Agentic Threat Detection (AG-DR) and Posture Management (AG-SPM) across the API action layer. Security leaders will walk away with a blueprint to map their ecosystems using an Agentic Security Graph and safely scale enterprise AI.

APIs are now the primary interface for modern digital businesses, concentrating identity, data, and control in a single layer, and making them a prime target for attackers. Across cloud, SaaS, and enterprise environments, adversaries increasingly exploit APIs for initial access, establish persistence using tokens or service identities, and move laterally through internal APIs and trusted service-to-service communication.      

This session breaks down the modern API-driven attack path using real-world incidents, explaining why API breaches so often escalate, why perimeter-based defenses fail to contain them, and how organizations can shift toward runtime detection and east-west containment. The focus is on resilience: limiting blast radius and keeping API incidents from becoming full-environment compromises.

Rapid changes in public-key infrastructure are reshaping operational and compliance tasks as certificate lifetimes shrink, browser policies evolve, as the industry begins migrating towards PQC(post quantum cryptography). This presentation outlines a practical action plan using automation for shorter certificate validity periods, preparedness for mass revocation, and phased adoption of NIST-approved post-quantum algorithms.  PKI operations made easy with pragmatic steps for now and the future.

Most security programs measure effort — not outcomes. Organizations patch thousands of vulnerabilities, deploy dozens of tools, and run annual tabletop exercises… but when an attacker shows up, none of that matters.  What matters is whether they can prove their defenses actually work.  

In this talk, Horizon3.ai shares how leading organizations are using autonomous pentesting to see their environment through the attacker’s eyes — continuously, safely, and at scale. By shifting from assumptions to proof, they’ve learned to:

• Prioritize what’s exploitable. Focus limited resources on the weaknesses that truly put the business at risk that are known to be abused by threat actors.

• Quickly fix what matters. Close the loop from find → fix → verify and reduce your exploitable attack surface.

• Reduce attacker dwell time. Use pentest results to precisely deploy honeyTokens to detect compromise early, and to continuously prove your EDR and SIEM are tuned and working as intended.  

Cyber resilience isn’t about being perfect — it’s about getting better over time. And the only perspective that truly matters is the attacker’s.

Abstract
AI and new digital technologies will continue to shift the cybersecurity landscape in 2026. This session explores how modern tools can enhance detection, response, and decision making while introducing new risks tied to generative systems, data integrity, and fast moving threat innovation. Leaders will gain a clear view of how to adopt emerging technology in a responsible and strategic way that supports resilience and aligns with enterprise risk goals.

Key Takeaways
• How AI and emerging tech are reshaping core security functions
• The new risks created by generative models and evolving attack techniques
• Practical governance steps that support responsible AI use
• Examples of organizations pairing innovation with disciplined risk management

Key themes include:

• Surge in ransomware targeting enterprise infrastructure        
• Convergence of cybersecurity and business continuity
• Growing role of mandates (DORA, CCPA, HIPAA, Cyber Insurance, C-Level, Board Level) in forcing measurable recovery benchmarks   
• What organizations must deliver to support enterprise resilience at scale

Drawing on enterprise experience and extensive volunteer-led workforce education and advocacy since leaving AT&T, I have focused on translating industry expectations into accessible, replicable pathways for career seekers. In most cases, the career individuals were coming from outside traditional corporate pipelines. My goal was to bridge the traditional ideology and educate on policy and industry to improve workforce readiness outcomes.

As AI rapidly transforms the cybersecurity landscape, organizations are facing a new generation of threats that are faster, smarter, and more scalable than ever before. In this fireside chat, Ayesha Khalid will explore how cybersecurity preparedness has dramatically evolved over the past two years as AI adoption has accelerated across industries.

The discussion will examine how attackers are leveraging AI to enhance phishing, social engineering, automation, and reconnaissance, while defenders race to modernize detection, response, and resilience strategies. Beyond the technology itself, the conversation will focus on how organizations are improving employee training, adapting security operations, and building cultures of preparedness that can keep pace with constant change.

Attendees will also hear insights into aligning cybersecurity strategy with business outcomes, balancing innovation with risk management, and preparing leadership teams for the realities of AI-driven disruption. From emerging threats to practical organizational readiness, this session will provide a forward-looking conversation on what it truly means to stay prepared in the age of AI.

Ransomware attacks have become more sophisticated than ever. 66% of organizations have experienced at least one attack in the past two years, and 96% of those target backup data. So, when—not if—a breach happens, and your business, reputation, and career are on the line, immutable backup storage is your best and last line of defense.  

However, if ‘immutable’ data can be overwritten by a backup or storage admin, a vendor, or an attacker, then it cannot be considered a storage solution with Absolute Immutability. In this presentation, learn how to make your backup data ransomware-proof with Absolute Immutability.

Artificial intelligence is accelerating how organizations operate—but it is also amplifying risk. As AI adoption expands, the speed, scale, and potential blast radius of data-related incidents are increasing at an unprecedented rate.    

This presentation explores how security leaders can evolve from traditional backup and recovery strategies to modern data resilience frameworks designed for the AI era. Attendees will learn how to ensure data integrity, maintain control over rapidly expanding identities—including AI agents—and recover with precision when incidents occur.    

Veeam will introduce a practical approach to achieving Data and AI Trust, enabling organizations to confidently embrace AI innovation while maintaining security, compliance, and operational continuity.

This session centers the perspective of CISOs and security leaders by examining what they most wish new cybersecurity graduates understood before entering the workforce. Rather than framing this as a critique of higher education, the presentation treats these insights as an opportunity for collaboration and curriculum improvement. Topics include technical foundations, professional communication, teamwork, ethical judgment, and the ability to navigate organizational security culture. The goal is to create a clearer bridge between academic preparation and operational expectations.

1) Assume Breach

2) Burnout in Cybersecurity

Joining a women's cybersecurity non-profit such as Women in CyberSecurity (WiCyS), is often cited as one of the most effective ways to accelerate a career in the field. Learn more from these panelists, discussing their career journeys, gaining insights to challenges, and how joining an organization such as WiCyS or an Affiliate can be beneficial, as the cybersecurity landscape grows increasingly complex.

Cyber Security is difficult, tricky, and hard for normal humans, especially if you try to go it alone. But by working together we can all be more safe and secure. As cyber security professionals, we do this all the time, working with our teams, inside our companies and across industries. Attending conferences like this one and sharing tips, tricks, and ideas. To extend this spirit of collaboration, I propose that everyone must have a cyber security buddy. In social settings, we enjoy the protective benefits of family and friends. They nudge us away from mistakes, and sometimes even stage interventions to stop us from true disasters. Cyber Security Buddies can similarly help us, both as “wing persons” who make sure you aren’t taken advantage of, and as cyber hygiene checkers, making sure our InfoSec doesn’t stink, or is even pretty good.