Autonomous ransomware is moving from “assistive AI” to end-to-end operations: automated recon, vulnerability discovery, lateral movement, privilege escalation, encryption, and even extortion workflows that adapt to defenses in real time. This panel breaks down what autonomy looks like in practice, where today’s tooling is already accelerating the kill chain, and which signals defenders can still use to detect and disrupt machine-speed attacks. Expect a grounded discussion of attacker economics, the most likely near-term scenarios, and what security leaders should prioritize as ransomware becomes faster, more targeted, and more scalable.

When ransomware can execute faster than humans can triage, resilience becomes the primary control. This panel focuses on pragmatic strategies that reduce “time-to-restore” and limit operational paralysis: immutable backups, recovery testing, tiered restoration plans, segmentation that actually holds, and identity hardening to prevent backup and admin takeover. Panelists will share what works under pressure, how to avoid “paper resilience,” and how to align technical recovery with real business continuity requirements—so the organization can keep functioning even if encryption and extortion hit at once.

Organizations are increasingly relying on AI in the SOC—triage, detection engineering, alert enrichment, copilots, and automated response. But autonomous ransomware raises a hard question: how much autonomy should defenders allow their own systems? This panel explores the balance between speed and control: safe automation patterns, guardrails for containment actions, anti-poisoning strategies, model risk management, and how to keep humans accountable when AI takes more of the wheel. You’ll leave with a practical framework for deploying AI-assisted defense without turning it into an attacker’s force-multiplier.