Over the past decade, organizations have invested billions into cybersecurity programs built on frameworks, maturity models, and compliance benchmarks. Yet breaches continue to accelerate—not because we lack tools, but because we’ve optimized for control in an environment defined by chaos.

This presentation challenges a core assumption of modern security: that we can meaningfully “control” risk in complex, distributed, and adversarial systems. Drawing on real-world incidents, supply chain compromises, and AI-driven attack evolution, this session reframes cybersecurity as a discipline of continuous resilience rather than static control.

The audience will gain an appreciation for: Why compliance-driven security creates a false sense of safety.  How attackers exploit organizational complexity, not just technical flaws. The shift from prevention-first to impact-aware resilience engineering and tips from the field to validate program effectiveness.

While events like FIFA and the Olympics bring together our global community in a celebration of sport and national pride, they also attract threat actors who target every aspect of the games. FIFA 2026 will be the first games to host forty-eight national teams across three countries and have the additional challenge of defending against an unprecedented hybrid landscape. This session will explore layered security considerations and how to coordinate our efforts to combat evolving threats.

Are you prepared to defend your organization against the evolving threats of the AI era? In this must-attend session, we reveal an innovative cybersecurity approach designed specifically for protecting AI systems and large language models (LLMs).

Most security programs measure effort — not outcomes. Organizations patch thousands of vulnerabilities, deploy dozens of tools, and run annual tabletop exercises… but when an attacker shows up, none of that matters.  What matters is whether they can prove their defenses actually work.  In this talk, Horizon3.ai shares how leading organizations are using autonomous pentesting to see their environment through the attacker’s eyes — continuously, safely, and at scale.

By shifting from assumptions to proof, they’ve learned to:

• Prioritize what’s exploitable. Focus limited resources on the weaknesses that truly put the business at risk that are known to be abused by threat actors.

• Quickly fix what matters. Close the loop from find → fix → verify and reduce your exploitable attack surface.

• Reduce attacker dwell time. Use pentest results to precisely deploy honeyTokens to detect compromise early, and to continuously prove your EDR and SIEM are tuned and working as intended.  

Cyber resilience isn’t about being perfect — it’s about getting better over time. And the only perspective that truly matters is the attacker’s.

Abstract
AI and new digital technologies will continue to shift the cybersecurity landscape in 2026. This session explores how modern tools can enhance detection, response, and decision making while introducing new risks tied to generative systems, data integrity, and fast moving threat innovation. Leaders will gain a clear view of how to adopt emerging technology in a responsible and strategic way that supports resilience and aligns with enterprise risk goals.

Key Takeaways
• How AI and emerging tech are reshaping core security functions
• The new risks created by generative models and evolving attack techniques
• Practical governance steps that support responsible AI use
• Examples of organizations pairing innovation with disciplined risk management

A forward‑looking look at how security teams can harness AI agents at machine speed while keeping humans firmly in control — redefining SOC operations for the Agentic Enterprise.

Canada has roughly 25,000 unfilled cybersecurity roles, and for fifteen years our industry has answered with the same prescription: train more people!. In late 2025, ISC2 quietly retired the workforce-gap metric that shaped this response, because the data now tells a different story. The real constraint on cybersecurity careers is no longer supply. It is signal: the visibility, trust, and access that turn trained talent into deployed capability. And the infrastructure that builds signal at every stage of a career is mentorship and network. 
This keynote shows why mentorship and sponsorship have become the highest-leverage career moves in our field, and how professionals at every level, from students to CISOs, can extend their networks deliberately in a hybrid era where casual connections have quietly faded.
Attendees will leave with a clear model for diagnosing where careers actually stall, a working distinction between mentorship and sponsorship, and practical ways to build the kind of network that accelerates careers and helps close the workforce gap we have been unable to train its way out of.

Abstract:
As organizations expand their digital ecosystems, risks extend far beyond internal networks. Threat actors are increasingly exploiting supply chains, third-party vendors, and identity gaps to gain access. This session brings together cybersecurity leaders and solution providers to explore how these interwoven risks create a complex attack surface -and how technology can help mitigate them.

Panelists will share real-world examples, lessons from managing large vendor networks, and innovative tools and frameworks for continuous risk assessment. Discussions will highlight strategies for mapping hidden dependencies, enforcing strong identity governance, and strengthening resilience through automation, collaboration, and transparency. Attendees will gain actionable insights on reducing exposure, improving third-party risk visibility, and leveraging technology to secure their extended digital ecosystem.

Key Takeaways:
• Understand how supply chains, vendors, and identities amplify organizational risk.
• Explore practical methods and tools for assessing, monitoring, and mitigating third-party and ecosystem vulnerabilities.
• Learn how to treat identity as a security perimeter using zero trust, access governance, and automated solutions.
• Gain insights from real-world breaches that reveal common gaps in vendor and identity controls.
• Walk away with a technology-informed framework to enhance resilience, secure partnerships, and reduce exposure across your digital ecosystem.

As threats have evolved so too has the approach to Modern Identity Security. A Privilege-Centric approach must be adopted and considered with this evolution. Identity and user management for all accounts within an organization must mature to meet the demands of the cloud, nonhuman identities, Agentic AI and modern attack vectors. Your PAM strategy must now manage and mitigate not only traditional privileged access (root and admin) but also attacks against identities with a path to privileged access.  

These paths to privilege still remain one of the most valuable targets for cybercriminals because many organizations are defending their environments with fragmented or siloed security strategies and solutions. Security gaps and risks lie in endpoints, cloud environments, Saas Applications, third-party access and now Agentic AI and NHI which make the battleground even harder to defend.  

Identity Security builds on the foundation of defense-in-depth, coupling visibility with least privilege and Zero Trust while addressing critical risks with priority and exposing less-than critical risks for awareness.  Leverage a strategy that works, improves compliance, helps meet cyber insurance mandates, enhances security posture, while giving you the visibility needed to protect your environment.

Cybersecurity is more than protecting systems and data - it is also about strengthening communities, mentoring future leaders, and creating opportunities for others to succeed. Join cybersecurity leader and community advocate Isaac Ojeh in conversation with J.D. Miller, SVP at CyberRisk Alliance, for a fireside discussion on the importance of volunteering and giving back as a cybersecurity professional.

Drawing from Isaac’s extensive involvement in mentorship, education, outreach, and community leadership, the session will explore how giving back can shape careers, expand professional networks, and help address some of the industry’s biggest challenges, including workforce development and accessibility. Attendees will leave with practical ideas for getting involved and a deeper understanding of why community engagement has become an essential part of leadership in cybersecurity.

As we move into 2026, the cybersecurity landscape has shifted from managing "tools" to governing "entities." The rise of autonomous AI agents has introduced a profound Identity Crisis: these digital coworkers possess the agency to plan, execute, and collaborate, yet they often operate in a grey zone of accountability.

This challenge is compounded by the explosion of Shadow AI. Much like the "Shadow IT" of the past decade, employees are now deploying unsanctioned autonomous agents to bypass organizational friction. These "Ghost Insiders" operate outside traditional IAM visibility, creating a massive surface area for machine-speed breaches and lateral movement. When a Shadow AI agent misinterprets a goal or escalates its own privileges, it becomes an unmanaged Insider Threat that no traditional firewall can stop.

In this session, we will move beyond the technical stack to explore a new leadership doctrine required for the agentic era. We will dissect the mechanics of Non-Human Identity and the urgent need for a "Linguistic Firewall" to secure autonomous intent. Attendees will learn how to practice Strategic Override—the high-stakes art of knowing when to empower an autonomous system and exactly when to reclaim human command.

Leadership in 2026 is no longer about supervising human output; it is about governing delegated intent. Join us to learn the framework for leading a workforce that is increasingly autonomous, inherently risky, and often invisible.

Abstract:
Cybersecurity challenges are complex, and solving them requires teams with diverse perspectives, skills, and experiences. This panel explores how diversity drives better problem-solving, innovation, and threat detection in security organizations.

Panelists will share strategies for attracting and retaining talent from varied backgrounds, leveraging unique thinking styles, and applying different experiences to uncover blind spots in risk management. Attendees will gain actionable insights for building teams that are not only technically skilled but more adaptive, creative, and resilient in the face of evolving cyber threats.

Key Takeaways:

• Understand how diversity strengthens problem-solving, innovation, and threat response.
• Learn approaches to recruit and retain talent from non-traditional backgrounds.
• Explore how different perspectives and thinking styles reveal hidden risks.
• Gain strategies to create teams that are adaptable, collaborative, and resilient.
• Walk away with practical ideas for integrating diversity into cybersecurity team design and strategy.

As agentic AI moves from experiment to enterprise, organizations are granting autonomous workloads broad access through the same static API keys and shared service accounts used a decade ago — creating a fleet of high-autonomy systems with no verifiable identity, no audit trail, and no way to enforce least privilege. AI agents don't just run code; they call APIs, query databases, escalate privileges, and spawn sub-agents, making them first-class security principals that demand first-class identity controls. This session examines how cryptographic workload identity eliminates secret sprawl, enables short-lived credentials that expire before they can be weaponized, and creates a tamper-evident attribution chain across multi-agent workflows.

In this closing keynote, Jonathan will detail how cyber insurance is a strategic and financial risk transfer that keeps businesses and operations resilient against today’s cyber threats. He’ll also detail how security programs and their teams can work together in partnership with insurers to decrease cyber and operational risks.