Join us for breakfast from 7:30 AM to 9:00 AM and take advantage of a relaxed opportunity to network with peers, speakers, and industry leaders before the conference program gets underway.
Move Fast and Don't Break Things: A New Model for AI Governance
● Focus
📍 Focus Track (Salon IV)
(Breakfast Session)
Every enterprise wants to move faster with AI, but most governance programs slow that down because they were built for humans, not machines.(Breakfast Session)
Every enterprise wants to move faster with AI, but most governance programs slow that down because they were built for humans, not machines. AI agents act in milliseconds, often with more access than any single task requires, and most governance programs lose sight of what they’re doing once they’re running.
Companies often feel forced into a false choice: lock AI down and slow the business or move fast and lose control. The companies pulling ahead rejected that trade-off entirely. They rebuilt their controls to match the speed of AI, getting more agents into production faster, with a complete record of every action to back it up.
This session shows how, and what becomes possible when authorization stops being a policy you set once and starts keeping pace with every decision your AI makes.read more
If you’ve been anywhere near modern AI research lately, you’ve probably heard people buzzing about Chain of Thought (CoT). It's the idea that advanced AI models don’t just spit out an answer—they produce a whole internal reasoning trail behind it.If you’ve been anywhere near modern AI research lately, you’ve probably heard people buzzing about Chain of Thought (CoT). It's the idea that advanced AI models don’t just spit out an answer—they produce a whole internal reasoning trail behind it. Think of it as the AI’s scratchpad or its inner monologue. And monitoring that monologue? That’s the new frontier of AI safety.
As AI systems evolve from predictive models to reasoning-driven agents, traditional governance approaches—focused primarily on outputs and outcomes—are becoming increasingly insufficient.
This presentation introduces Chain-of-Thought (CoT) Monitorability as an emerging and critical capability for strengthening AI risk management, particularly in high-stakes environments such as financial services.
Modern reasoning models generate intermediate deliberations before producing final outputs. These reasoning traces offer a partial but valuable window into how models arrive at decisions, enabling earlier detection of risks such as reward hacking, hidden policy violations, or deceptive behavior that may remain invisible in output-only evaluations. CoT monitorability shifts oversight from evaluating what a model produces to understanding signals about why the model behaves as it does.
The presentation outlines a practical governance framework to operationalize CoT monitorability within existing Model Risk Management (MRM) and AI governance programs. Key elements include:
Treating monitorability as a distinct, measurable risk attribute alongside accuracy, bias, and robustness
Classifying models based on whether they exhibit reasoning behavior
Implementing structured monitorability evaluations (intervention, process, and outcome-based approaches)
Integrating monitorability insights into risk-informed deployment decisions
Establishing continuous tracking to detect degradation over time
Attendees will also gain clarity on where CoT monitoring adds meaningful value—such as in agentic workflows, fraud detection, and AI-assisted decision support—and where it may be insufficient or misleading. Practical implementation considerations around cost, accountability, and integration into governance processes will be discussed, including the trade-offs associated with increased reasoning visibility.
The session concludes with key guardrails to prevent over-reliance on reasoning traces and emphasizes the urgency of adopting monitorability frameworks while the current “window of visibility” remains open.
This presentation is designed for AI governance leaders, model validators, and risk professionals seeking to evolve their oversight frameworks to address the unique challenges posed by next-generation reasoning systems.read more
Anant SomvanshiSr. Specialist - AI Defense Office - Vanguard
☆
Tue Aug 11 · 9:00 AM - 9:35 AM
The New Security Model: When Software Stops Following Instructions
● Strategy
📍 AI Risk Summit Strategy Track (Salon I)
For the last thirty years, we have secured software that follows instructions. The next thirty years will be about securing software that makes decisions.For the last thirty years, we have secured software that follows instructions. The next thirty years will be about securing software that makes decisions. That shift, from deterministic applications to reasoning, planning, tool-using agents, breaks the assumptions behind the controls we have relied on for a generation.
This keynote traces three shifts every security leader will have to reckon with. First, the security model itself is changing, because least privilege, identity, and policy were all designed for software that behaves predictably, and agents do not. Second, risk is no longer simply increasing, it is compounding, as every new tool, permission, memory source, and API multiplies the range of possible behaviors. Third, success is no longer measured by what you block, but by how safely AI completes useful work.
Along the way, we will be honest about what the industry has not yet solved, because no one has completely solved this yet. The more useful question is not which product claims total coverage, but what a credible path forward actually looks like: a move from policies to behavior, from blocking to observability, from stopping AI to helping it succeed safely. Attendees will leave with a new way to think about securing decision-making software, and a framework for evaluating where their own strategy needs to evolve. (Presented by F5)read more
Attackers Figured Out That Your GenAI Deployment Is the Easiest Way Into Your Enterprise
● Tech
📍 AI Risk Summit Tech Track (Salon II)
For years the security conversation around AI was about how attackers would use AI as a weapon: deepfakes, automated phishing, AI-generated malware. That conversation is still valid but it is missing something.For years the security conversation around AI was about how attackers would use AI as a weapon: deepfakes, automated phishing, AI-generated malware. That conversation is still valid but it is missing something. The more immediate problem is that enterprises have deployed AI systems as first-class infrastructure components, given them access to sensitive data and internal APIs, and connected them to identity systems that can reach most of the organization. That infrastructure is now an attack surface, and it is one that most enterprise security programs have not finished building controls around.
I published research on adversarial attacks against cloud AI workloads that received the Best Paper Award at IEEE ICAIC 2025. The core finding from that work and from the production security programs I run is consistent: the attack paths into enterprise AI systems are not exotic. They rely on the same principles as web application attacks from fifteen years ago, applied to an environment where the security discipline is still catching up. Prompt injection is the new SQL injection. Over-permissioned AI service accounts are the new over-privileged database users. And just like those earlier problems, the window before attackers routinely exploit these patterns at scale is closing.
This session covers the adversarial threat landscape for enterprise GenAI deployments with enough technical grounding to be actionable but framed for the risk and security leadership audience that has to make resourcing and prioritization decisions. I'll walk through the attack classes: direct and indirect prompt injection, training data extraction, model inversion, and the abuse of AI agent tool access to pivot through enterprise infrastructure. For each I'll cover what realistic exploitation looks like, what evidence it leaves behind, and what controls actually reduce the risk in enterprise environments that are already running these systems.
The second half of the session addresses the strategic question CISOs are actually wrestling with: how do you build a security program around AI systems that are changing faster than your risk assessment cycles? I'll cover the framework we use to continuously evaluate AI deployment risk, the metrics that matter for board reporting, and the organizational changes that separate enterprises that are managing AI risk from enterprises that are hoping nothing goes wrong.
The organizations in this room are past the question of whether to deploy AI. The question now is how to do it without handing attackers a new category of access to everything you've spent years trying to protect.
Attendees will leave with an adversarial threat model for enterprise GenAI, a prioritized set of controls mapped to realistic attack paths, and a framework for continuous AI risk assessment that keeps pace with deployment velocity.read more
Building the Defender Advantage in an AI-First World
● CISO Forum
📍 CISO Forum Track (Salon III)
AI has fundamentally changed the way enterprises think about security, not just because it introduces new risks, but because it changes the speed at which everything happens.AI has fundamentally changed the way enterprises think about security, not just because it introduces new risks, but because it changes the speed at which everything happens. Organizations are moving beyond experimentation and into large-scale AI deployments, forcing security leaders to rethink how they protect both their environments and the AI systems running inside them.
This session explores how CISOs can build a "Defender Advantage" in an AI-first world. Drawing on conversations with large enterprises and emerging trends across the industry, Michael will discuss how AI is changing security operations, why response time is becoming the defining metric, and what security leaders should be doing today to prepare their organizations for what's next.read more
Michael MontoyaChief Technology Operations Officer - F5
☆
Tue Aug 11 · 9:35 AM - 10:10 AM
The New Fog of War: Hidden Threats in an AI-Dominant World
● Strategy
📍 AI Risk Summit Strategy Track (Salon I)
For most mature organizations, traditional security controls are no longer the hard part. Detection engineering, hardening, identity, cloud security, compliance, even many forms of threat hunting have become table stakes.For most mature organizations, traditional security controls are no longer the hard part. Detection engineering, hardening, identity, cloud security, compliance, even many forms of threat hunting have become table stakes. But in an AI-dominant world, the most consequential threats increasingly emerge outside the boundaries those programs were designed to defend.
This keynote asks a more basic question: do you actually know your assets, your risks, and your boundaries? Trust underpins all three, yet most security programs still treat trust as static and well understood. AI increases speed, scale, and ambiguity, making it harder to continuously validate who belongs inside the organization, which outside relationships create exposure, and where the company’s real operational edges actually are. Most security programs are still control-led rather than threat-led: they begin with tools, telemetry, and detections instead of a clear understanding of how adversaries will exploit the seams between people, third parties, and institutional boundaries. Before you can detect or disrupt a threat, you have to know where it is most likely to form.
The central challenge for security leaders is no longer just building stronger controls. It is learning to see earlier, wider, and more clearly. This talk argues for a threat-led approach to security in which identification comes first: understanding how threat behavior is changing, where conventional programs have blind spots, and how to illuminate the hidden surfaces where the next generation of risk is already forming. In an environment shaped by AI, better security will belong to organizations that can turn threat identification into sharper judgment, faster orientation, and more decisive action before the fog closes in.read more
Alex LevinsonCEO - 8oS Global
Built for you by(617)-PATRICK, Champion AI speaker
Iran Tested It First: What State-Sponsored Deepfakes Mean for Every CISO in the Room
● CISO Forum
📍 CISO Forum Track (Salon III)
Over the course of the 2026 war with Iran, hundreds of unique AI-generated deepfakes pushing pro-Iran narratives have been identified.Over the course of the 2026 war with Iran, hundreds of unique AI-generated deepfakes pushing pro-Iran narratives have been identified. Fake missile strikes, fabricated battlefield victories, synthetic news broadcasts, AI-generated images confirmed by Google's own watermarking tool, and a video that hit 70 million views before anyone traced it to a military video game. The volume wasn't an accident. It was the strategy. The goal isn't to make you believe any single fake. It's to make you doubt everything you see. This is the liar's dividend — and it isn't staying in the Middle East.
State actors are running the world's most sophisticated adversarial AI lab, and enterprise security teams are the next target. Drawing on original research from the Foundation for Defense of Democracies, this talk examines how Iran, Russia, and China have developed distinct but mutually reinforcing roles in AI-enabled influence operations: Iran as the content lab, Russia as the amplification infrastructure, and China as the precision targeting engine. The tactics being refined against governments and militaries today become commodity tools available to criminal enterprises within months, not years.
This talk goes beyond threat awareness. Attendees will leave with a clear-eyed view of where platform detection is failing — Meta's metadata-only gaps, Grok's contradictory deepfake assessments, Google AI summaries validating disinformation — and what those failures reveal about enterprise defense posture. FDD's research goes deeper still, including original work on how authoritarian propaganda patterns are baked into the LLMs your organization already relies on. The national security intelligence is the early warning. The enterprise implications are the talk.
Leah Siskind is an AI Fellow and Director of Impact at FDD's Center on Cyber and Technology Innovation, a veteran of the U.S. Digital Service in the White House and DHS AI Corps, and a recognized voice on adversarial AI. She has written on deepfakes for The Cipher Brief, The National Interest, and has spoken on the topic on Fox News, including on the Brian Kilmeade Show and Fox News Live.read more
Leah SiskindDir of impact and AI research fellow - Foundation for Defense of Democracies
☆
Tue Aug 11 · 10:10 AM - 10:45 AM
Shaken, not Secured: A Dossier for Closing the AI Visibility Gap
● Tech
📍 AI Risk Summit Tech Track (Salon II)
In the movies, secret agents are either protecting the mission or quietly undermining it.In the movies, secret agents are either protecting the mission or quietly undermining it. The scary part is that they often look the same at first: both have credentials, both have access, and both move through restricted areas without setting off alarms.
As AI infiltrates everyday apps and agent builders, security teams can't settle for tailing a known watchlist of AI tools; they need eyes on a constantly shifting network of double agents—AI embedded in other SaaS tools, agents, integrations, and permissions that traditional network- and endpoint-based security tools were never built to surveil.
This session unpacks why shadow AI reconnaissance is a different mission entirely from past shadow IT operations, and how today's organizations are adapting their tradecraft to keep up. Attendees will leave with a field-tested framework for closing their AI visibility gap, a clear briefing on why discovery is the precondition for every other security control, and a solid case for unlocking budget across security, AI innovation, and compliance.
Because every successful mission starts with good intelligence.read more
Patrick DillonCRO - Nudge Security
☆
Tue Aug 11 · 10:10 AM - 10:45 AM
When Trust Has No Security: AI Risks Everything
● Strategy
📍 AI Risk Summit Strategy Track (Salon I)
Organizations are deploying AI systems that are fully compliant :SOC 2, HIPAA, ISO 27001, GDPR, ect and are still fully exposed.Organizations are deploying AI systems that are fully compliant :SOC 2, HIPAA, ISO 27001, GDPR, ect and are still fully exposed. This talk dismantles the illusion that traditional security controls and compliance frameworks protect AI models, walking through a real-world attack chain that compromises a healthcare AI assistant in under two hours through nothing more than a hidden prompt injection.
Drawing on universal jailbreak techniques that bypass safety alignment across every major LLM, Harkins introduces the "Irrefutable Laws of Securing AI" and the 9-Box of AI Trust & Security framework, reframing the problem from probabilistic risk to deterministic exposure: if a model is exploitable, compromise is a matter of when, not if.
Attendees will leave with an understanding for closing the gap between AI that is well built, well run, and genuinely trustworthy.read more
Effective governance should accelerate, not hinder, AI adoption.Effective governance should accelerate, not hinder, AI adoption.
This session asserts that well-architected risk management does not have to be a barrier for an enterprise, but can instead be the very mechanism that enables a business to move faster, in a secure way. This session will explore how current practices, particularly in Third-Party Risk Management (TPRM), often reveal contradictions: rigorous evaluation frameworks are bypassed when speed is prioritized, exposing a gap between stated risk tolerance and actual behavior.
Additionally, this presentation will highlight the critical but under-examined tradeoff between time investment and risk severity: evaluating whether exhaustive assessments truly reduce AI and security risk.
Attendees will learn:
- Why traditional risk management approaches unintentionally slow AI adoption (and how to fix that)
- Where dread risk and the investigatory reflex impact security decisions around AI
- How cognitive biases like loss aversion, target fixation and salience bias distort AI risk decisions, specifically among security leaders
- A practical method for aligning evaluation effort with actual risk (time and impact evaluated)
- Why assigning clear risk ownership is critical for both speed and accountabilityread more
Keavy MurphyVP - Security - Net Health
☆
Tue Aug 11 · 11:00 AM - 11:30 AM
Trustworthy AI in Healthcare: Defending the New Attack Surface
● CISO Forum
📍 CISO Forum Track (Salon III)
Tagline : From deepfakes to data leakage—how CISOs build AI that’s safe, compliant, and resilient.Tagline : From deepfakes to data leakage—how CISOs build AI that’s safe, compliant, and resilient.
Healthcare is adopting AI fast—virtual agents, analytics, automation—but that also creates a brand-new attack surface: adversarial prompts, deepfakes, model and data poisoning, and high-impact failures that can erode patient trust overnight. In this session, I’ll share a CISO’s practical playbook for securing AI in healthcare: governance aligned to NIST AI RMF and ISO/IEC 42001, protecting PHI in AI/ML pipelines, building an AI integration roadmap that doesn’t slow innovation, and operationalizing “AI for defense” to strengthen detection and response. You’ll leave with a clear framework to reduce risk, meet regulators where they are heading, and confidently scale AI in regulated environments.read more
Raj SinghNorth America CISO - Sagility Health
☆
Tue Aug 11 · 11:00 AM - 11:30 AM
When AI Coding Agents Become an Attack Surface: Lessons from Claude Code RCE Research
● Tech
📍 AI Risk Summit Tech Track (Salon II)
AI coding agents like Claude Code, Cursor, and Gemini CLI are moving from autocomplete into autonomous development workflows, where they can read code, run commands, use tools, and interact with cloud environments.AI coding agents like Claude Code, Cursor, and Gemini CLI are moving from autocomplete into autonomous development workflows, where they can read code, run commands, use tools, and interact with cloud environments. In this session, Mahesh Babu (Kodem) will share lessons from newly disclosed Claude Code remote code execution research presented at RSAC 2026, building on earlier work around denial-of-service and permission escape. We will explain how these risks show up in real developer environments, why agent autonomy changes traditional application security assumptions, and what practical controls security teams should consider as these tools enter the enterprise.read more
KV-Cache as Attack Surface: Side Channels in Shared LLM Inference Infrastructure
● Tech
📍 AI Risk Summit Tech Track (Salon II)
Most people think about LLM security at the prompt level. What goes in, what comes out. But there's an entire layer underneath, the KV-cache, and it has some properties that should make anyone running shared inference infrastructure genuinely uncomfortable.Most people think about LLM security at the prompt level. What goes in, what comes out. But there's an entire layer underneath, the KV-cache, and it has some properties that should make anyone running shared inference infrastructure genuinely uncomfortable.
Here's the problem: when a transformer model processes text, it doesn't recompute everything from scratch every time. It caches intermediate computations, the key-value pairs from the attention mechanism, so it can reuse them for efficiency. That's great for latency and cost. It's less great when multiple tenants share the same inference hardware, because those cached states don't always get cleaned up the way you'd expect.
This talk is about what happens in that gap.
We'll get into the mechanics of how KV-caches work, why they exist, and specifically where the isolation assumptions break down in multi-tenant deployments, including managed API services, on-premise inference clusters running vLLM or TensorRT-LLM, and enterprise platforms built on shared GPU pools.
We'll walk through a concrete demonstration on a locally hosted open-weight model, nothing proprietary, nothing that requires a vendor's cooperation to reproduce. The goal is to show this isn't theoretical. It's measurable, it's repeatable, and the conditions for it exist in a lot of production deployments right now.
The second half of the talk pivots to what you can actually do about it.read more
The Shadow Risk Problem: Governing Security Exceptions in AI-Driven Systems
● Strategy
📍 AI Risk Summit Strategy Track (Salon I)
Security programs increasingly rely on exceptions, waivers, and risk acceptances to keep critical systems running under tight delivery timelines. But in AI‑driven and highly automated environments, these exceptions create shadow risk—hidden exposures that are rarely tracked or governed.Security programs increasingly rely on exceptions, waivers, and risk acceptances to keep critical systems running under tight delivery timelines. But in AI‑driven and highly automated environments, these exceptions create shadow risk—hidden exposures that are rarely tracked or governed. A clear example is the Chevrolet dealership incident, where a ChatGPT‑powered chatbot was tricked into “agreeing” to sell a $60,000+ SUV for $1 through simple prompt‑injection, due to missing guardrails and uncontrolled overrides. This real‑world failure shows how unmanaged exceptions in AI systems can quickly escalate into operational, reputational, and security threatsread more
Devashri DattaSecurity and Open Source Leader - NVIDIA
☆
Tue Aug 11 · 11:30 AM - 12:00 PM
When AI Goes Wrong: A Practical Framework for Ethical Decision-Making in Rogue and Failing AI System
● CISO Forum
📍 CISO Forum Track (Salon III)
As AI systems move into high-stakes enterprise and societal decisions, failures are no longer hypothetical—they are inevitable. Yet most organizations are unprepared to respond when AI systems behave unpredictably, produce harmful outputs, or operate outside intended constraints.As AI systems move into high-stakes enterprise and societal decisions, failures are no longer hypothetical—they are inevitable. Yet most organizations are unprepared to respond when AI systems behave unpredictably, produce harmful outputs, or operate outside intended constraints.
This session introduces a novel, practitioner-driven framework for managing AI failures and “rogue AI” scenarios through structured ethical decision-making. Rather than focusing on abstract principles, we present a real-world operational model that helps organizations detect, assess, and respond to AI failures in real time.
At the core of this session is the “Ethical Failure Response Model (EFRM),” a decision framework that integrates risk severity, stakeholder impact, reversibility, and system autonomy into a clear response strategy. Attendees will learn how to classify AI failure modes—including hallucinations, adversarial manipulation, emergent behaviors, and model drift—and apply appropriate containment and remediation actions.
We will also explore the emerging concept of “ethical blast radius,” helping leaders quantify the downstream impact of AI failures across customers, employees, and regulatory exposure. Through realistic scenarios, we will demonstrate how organizations can balance speed, accountability, and transparency when responding to AI incidents.
Key takeaways:
* A structured taxonomy of AI failure and rogue behavior patterns
* The Ethical Failure Response Model (EFRM) for real-time decision-making
* A practical method to quantify ethical and reputational impact (“blast radius”)
* Governance patterns for incident response, escalation, and auditability
This session is designed for CISOs, risk leaders, AI engineers, and product executives who need actionable strategies to manage AI failures responsibly—before they become organizational crises.read more
AI at the Edge of Trust: Securing the Next Wave of Enterprise Intelligence
● CISO Forum
📍 CISO Forum Track (Salon III)
AI is reshaping enterprise operations while introducing new security risks, from model manipulation and data exposure to adversarial attacks and autonomous agent behavior.AI is reshaping enterprise operations while introducing new security risks, from model manipulation and data exposure to adversarial attacks and autonomous agent behavior. As organizations scale AI across endpoints, cloud, and edge, CISOs must rethink how trust, data integrity, and system control are established and maintained.
This session examines practical approaches to securing AI-enabled environments, including governance and monitoring of AI agents as they take on decision-making roles. Topics include safeguarding data pipelines, ensuring verifiable system integrity, and managing risks introduced by autonomous actions.
The discussion will focus on emerging security patterns and lessons from across the industry, highlighting how leaders are balancing innovation with risk—implementing guardrails, aligning to evolving regulations, and preparing for a future where AI systems must be both trusted and continuously verified. (Presented by Intel)read more
Ajit JoshiSr Dir, Engineering, Platform Security and Services - Intel
☆
Tue Aug 11 · 12:00 PM - 12:30 PM
Beyond Vibes: Evaluation Strategies for Safe Multi-Turn AI Agents
● Tech
📍 AI Risk Summit Tech Track (Salon II)
Evaluating whether an AI agent completes a task is hard. Evaluating whether it does so safely is harder — and most teams have no systematic way to catch failures before users do.Evaluating whether an AI agent completes a task is hard. Evaluating whether it does so safely is harder — and most teams have no systematic way to catch failures before users do. What breaks when you try to measure safe behavior across multi-step, non-deterministic agent workflows? Why aren’t classic eval pipelines built for this? And what practical evaluation strategies actually work? This talk tackles all three, offering concrete patterns — from trajectory-level assertions to adversarial scenario generation to safety-aware scoring rubrics — for teams shipping agents today. Drawing on experience building LLM evaluation frameworks and production safety systems at scale, we go beyond surface-level pass/fail metrics to show how you can build real, repeatable confidence that your agent is behaving as intended.read more
Eti RastogiSr. Applied Scientist - Amazon
☆
Tue Aug 11 · 12:00 PM - 12:30 PM
Proving Cyber Resilience: Measuring Outcomes, Not Effort
● Strategy
📍 AI Risk Summit Strategy Track (Salon I)
Most security programs measure effort — not outcomes. Organizations patch thousands of vulnerabilities, deploy dozens of tools, and run annual tabletop exercises… but when an attacker shows up, none of that matters.Most security programs measure effort — not outcomes. Organizations patch thousands of vulnerabilities, deploy dozens of tools, and run annual tabletop exercises… but when an attacker shows up, none of that matters.
What matters is whether they can prove their defenses actually work.
In this talk, Horizon3.ai shares how leading organizations are using autonomous pentesting to see their environment through the attacker’s eyes — continuously, safely, and at scale. By shifting from assumptions to proof, they’ve learned to:
• Prioritize what’s exploitable. Focus limited resources on the weaknesses that truly put the business at risk that are known to be abused by threat actors.
• Quickly fix what matters. Close the loop from find → fix → verify and reduce your exploitable attack surface.
• Reduce attacker dwell time. Use pentest results to precisely deploy honeyTokens to detect compromise early, and to continuously prove your EDR and SIEM are tuned and working as intended.
Cyber resilience isn’t about being perfect — it’s about getting better over time. And the only perspective that truly matters is the attacker’s.read more
James McCarthyManager, Sales Engineering - Horizon3.ai
From Strategy to Action: How CISOs Are Rewiring Security for the AI Era
● CISO Forum
📍 CISO Forum Track (Salon III)
AI is compressing the time security teams have to identify risk, make decisions, and respond. For CISOs, gaining an advantage will require more than deploying new tools.AI is compressing the time security teams have to identify risk, make decisions, and respond. For CISOs, gaining an advantage will require more than deploying new tools. It will mean rethinking security operations, governance, architecture, and how teams work across the enterprise.
In this discussion moderated by F5 CISO Chris Burger, leading CISOs will examine how they are adapting their security organizations for the AI era. The panel will explore where AI is already improving detection, investigation, and response; how organizations are securing rapidly expanding enterprise AI deployments; and what is required to move from experimentation to operational readiness. Panelists will share the decisions they are making today, the obstacles they continue to encounter, and the metrics they are using to determine whether their organizations are becoming faster, more resilient, and better prepared for what comes next.read more
Christopher BurgerCISO - F5
Julien SorianoDeputy CISO - NVIDIA
Joseph KamauCISO - CSAA Insurance
☆
Tue Aug 11 · 1:30 PM - 3:00 PM
Intel Executive Security Leadership Roundtable: Securing the AI-Driven Enterprise
● Focus
📍 Focus Track (Salon IV)
[ Invitation-Only Executive Customer Advisory Roundtable]
In an environment defined by rapid technological change and expanding risk, CISOs are re-evaluating how security is designed, deployed, and measured.[ Invitation-Only Executive Customer Advisory Roundtable]
In an environment defined by rapid technological change and expanding risk, CISOs are re-evaluating how security is designed, deployed, and measured. This private roundtable provides a forum for candid discussion among security leaders on emerging priorities—from AI risk and platform security to simplification and resilience.
Intel will facilitate an open dialogue to capture frontline insights, validate key trends, and explore how platform innovation can better align with enterprise security needs—helping shape the next generation of trusted computing.read more
Emily RyanCommercial Client Security Director - Intel
☆
Tue Aug 11 · 1:30 PM - 2:15 PM
Red-Teaming Generative AI at Scale: The $14B Hallucination Scenario
● Strategy
📍 AI Risk Summit Strategy Track (Salon I)
Topic: Red-Teaming Generative AI at Scale: The $14B Hallucination Scenario
Format requested: 45-minute interactive workshop (talk + hands-on red-team exercise + Q&A)
Track fit: Adversarial AI & Deepfakes; AI Failures and Rogue AI Mitigation; National security implications
Author: Anna R.Topic: Red-Teaming Generative AI at Scale: The $14B Hallucination Scenario
Format requested: 45-minute interactive workshop (talk + hands-on red-team exercise + Q&A)
Track fit: Adversarial AI & Deepfakes; AI Failures and Rogue AI Mitigation; National security implications
Author: Anna R. Dudley
Generative Artificial Intelligence (AI) has crossed from interesting tool to load-bearing infrastructure. Banks use it to draft credit memos. Intelligence shops use it for first-draft assessments. Law firms use it for discovery review. The failures that matter are no longer cosmetic. They are operational, and they cascade.
This 45-minute interactive workshop walks security and risk practitioners through one fully developed adversarial scenario: a confident hallucination, propagated through automated downstream systems, that produces a $14 billion exposure event before any human catches it. Attendees see the failure unfold across three layers and trace which controls would have caught it at each stage.
1. Model output
2. System integration
3. Human review
The methodological backbone is Cross-Validated Red Cell: a substantially rebuilt contrarian technique that combines adversarial Machine Learning (ML), Monte Carlo simulation over evidence, and adversarial-injection modeling to attack AI-assisted analysis where it is structurally vulnerable. It is one of four redesigned Structured Analytic Techniques (SATs) for the generative era all anchored in the Analyst-in-the-Loop AI (AITL) principle: AI surfaces, analyst decides.
Attendees leave with a five-step Monte Carlo red-team protocol they can run on any generative-AI deployment in their organization, a taxonomy of three operational failure modes (Plausible-Sounding Synthesis, Confident Hallucination, Source Traceability Collapse), and a worked artifact that converts model output into something a risk committee can interrogate.read more
Anna DudleyPrincipal Advisor for Special Projects - Altamira Corporation
☆
Tue Aug 11 · 1:30 PM - 2:15 PM
Stopping Rogue Agents in Flight: Real-Time Detection and Autonomous Containment for Enterprise AI
● Tech
📍 AI Risk Summit Tech Track (Salon II)
A compromised AI agent can execute ten irreversible tool calls in the time it takes a security log to reach your SIEM. By the time an analyst sees the alert, the data may already be gone.A compromised AI agent can execute ten irreversible tool calls in the time it takes a security log to reach your SIEM. By the time an analyst sees the alert, the data may already be gone.
At Salesforce, we defend large-scale autonomous agent deployments across thousands of organizations and millions of daily prompts. At AI Risk Summit 2025, I shared how we detect rogue agent behavior using unsupervised ML and engineered behavioral features over production telemetry. This year, I cover what comes next: detection alone is not enough.
This talk presents a runtime detection-and-response architecture for enterprise AI agents: an inline security service that subscribes to the agent event stream, scores each action against behavioral baselines in real time, and emits containment signals before the agent takes its next step.
The talk walks through the response taxonomy — session termination, per-tool restriction, retrieval redaction, step-up authentication, throttling, and egress blocking — and the hard part: deciding when each action should fire without creating more damage than the attack itself. Expect specifics on what broke, what remains unsolved, and the architectural tradeoffs every team deploying AI agents will eventually face.
Attendees will leave with a runtime detection-and-response reference architecture, a containment-action taxonomy ranked by blast radius and reversibility, and an opinionated deployment checklist to apply before their next agent ships.read more
Millie HuangPrinciple Data Scientist, Detection and Response - Salesforce
A Deep Dive into Model Context Protocol (MCP) Security
● Tech
📍 AI Risk Summit Tech Track (Salon II)
As AI systems become more powerful and context-aware, ensuring secure and reliable interaction with Large Language Models (LLMs) is paramount. Model Context Protocol (MCP) introduces a standardized interface that governs how models are prompted, contextualized, and deployed in real-world applications.As AI systems become more powerful and context-aware, ensuring secure and reliable interaction with Large Language Models (LLMs) is paramount. Model Context Protocol (MCP) introduces a standardized interface that governs how models are prompted, contextualized, and deployed in real-world applications.
This session explores the emerging security landscape of MCP, covering the potential risks introduced by context injection, prompt leakage, prompt chaining abuse, and data exfiltration through contextual inputs. Attendees will learn best practices for hardening MCP implementations across enterprise LLM stacks—whether proprietary or using API-based access like OpenAI, Anthropic, or Cohere.
From input validation and sandboxing to contextual trust boundaries, this session offers a strategic and technical roadmap to secure LLM interactions using MCP.
Key Takeaways:
* Understand the structure and components of the Model Context Protocol (MCP)
* Explore key threat vectors in context-driven LLM workflows
* Learn security best practices for MCP usage, including prompt hygiene, red teaming, and audit logging
* Dive into real-world attack scenarios such as indirect prompt injection and model manipulation via context chaining
* Recommendations for integrating MCP with existing AppSec and SOC workflows
Prerequisites:
Familiarity with Large Language Models, AI security principles, and API-based architecture.read more
Anshu GuptaCISO - Fixin Security
☆
Tue Aug 11 · 2:15 PM - 2:45 PM
Shadow AI and Third-Party Risk: Closing the Governance Gap
● Strategy
📍 AI Risk Summit Strategy Track (Salon I)
When an employee pastes sensitive data into ChatGPT, they have introduced an unvetted third party into your data environment with no contract, no assessed controls, and no exit plan.When an employee pastes sensitive data into ChatGPT, they have introduced an unvetted third party into your data environment with no contract, no assessed controls, and no exit plan. Responsibility for that risk is rarely assigned and often contested across TPRM, Security, Legal, and Privacy functions, leaving a meaningful gap in enterprise risk management programs that were never designed to see it.
This session reframes shadow AI as a governance and third-party risk problem rather than a behavior problem. Drawing on field observations and a practical maturity model, attendees will examine how to incorporate shadow AI into existing enterprise risk frameworks, why current standards including NIST AI RMF, ISO 42001, and Shared Assessments leave a structural gap, and what cybersecurity and governance strategies close it.
Attendees leave with a structured self-assessment, a cross-functional ownership model, and a prioritized action plan for integrating shadow AI risk into the enterprise risk management lifecycle.
Learning Objectives:
1. Explain why shadow AI creates a structural gap in existing TPRM and enterprise risk programs
2. Assign ownership using a practical cross-functional RACI model aligned to cybersecurity strategy
3. Use a structured self-assessment to evaluate maturity and prioritize control activitiesread more
The Underwriter in the Room: How Cyber Insurers Are Already Scoring Your AI Program
● CISO Forum
📍 CISO Forum Track (Salon III)
Most CISOs know AI introduces new risk. Far fewer know they're already being evaluated on it, or that the evaluation is happening quietly, every insurance renewal cycle, by people who set your premiums and write your policy exclusions.Most CISOs know AI introduces new risk. Far fewer know they're already being evaluated on it, or that the evaluation is happening quietly, every insurance renewal cycle, by people who set your premiums and write your policy exclusions.
Cyber insurance underwriters are rapidly building AI-specific risk assessment frameworks. They’re asking new questions, pulling new signals, and increasingly categorizing enterprise risks into preferred, standard, and high-risk AI tiers. The decisions they're making are affecting coverage availability, pricing, and even whether a claim gets paid when something goes wrong.
This session gives enterprise security and risk leaders an inside look at how AI programs are actually being underwritten today.
Drawing on data from CyRisk’s AI risk analytics platform used by cyber insurers to assess organizational AI posture at scale, attendees will learn which AI governance controls underwriters weight most heavily, which gaps trigger sublimits and exclusions, how agentic AI deployments are changing the assessment picture, and how to use the insurance market’s emerging AI pricing signals as a practical benchmark for your own risk quantification.
A key theme is how underwriting criteria both align with and diverge from familiar frameworks like NIST AI RMF and the EU AI Act. Where NIST and the Act define what good governance looks like in principle, insurance underwriting criteria are calibrated by actual loss data. They reflect what has already gone wrong and what it cost. The result is a more adversarially grounded view of AI risk that cuts through compliance theater and surfaces the controls that matter when a claim is on the table.
Attendees will leave with a concrete, insurer-tested framework for evaluating their AI program. One that satisfies both the boardroom and the underwriter, and that holds up when a loss actually occurs.read more
Ben GoodmanFounder & CEO - CyRIsk
Built for you by(617)-PATRICK, Champion AI speaker
5 Pillar Framework for Building an Enterprise AI Agents Governance and Security Program
● Strategy
📍 AI Risk Summit Strategy Track (Salon I)
Enterprises are deploying AI agents faster than any governance framework was designed to handle.Enterprises are deploying AI agents faster than any governance framework was designed to handle. AI agents make decisions, take actions, and interact with live enterprise systems in ways that are non-deterministic, difficult to audit, and rarely tied to a clear accountable owner.
The result is a governance vacuum. Security teams are responsible for the perimeter but not the agent. Legal owns data compliance but didn't approve the agent's tool access. Business units deployed the agent but don't monitor what it does post-launch. And when something goes wrong, a data leak, an unauthorized transaction, a compliance violation, nobody can reconstruct what the agent did, why, or on whose authority.
This session presents a practical enterprise governance framework built specifically for AI agents, designed from the ground up for the operational reality of autonomous systems acting inside corporate infrastructure.
This session introduces a 5-pillar governance framework built ground-up for agentic AI in enterprise environments, developed from real-world deployments and security incidents across industries.read more
Ankita GuptaCo-Founder & CEO - Akto IO Inc
☆
Tue Aug 11 · 2:45 PM - 3:15 PM
AI Agent Governance for Risk Leaders: Lessons from the Frontlines
● CISO Forum
📍 CISO Forum Track (Salon III)
As enterprises rapidly transition from passive LLM chatbots to autonomous AI agents capable of executing multi-step business tasks, risk leaders face an entirely new paradigm of operational danger.As enterprises rapidly transition from passive LLM chatbots to autonomous AI agents capable of executing multi-step business tasks, risk leaders face an entirely new paradigm of operational danger. Unlike static models, autonomous agents have the authority to act—calling APIs, querying databases, and modifying corporate environments. Knowing how to establish guardrails without halting business innovation has left many security leaders paralyzed. This session cuts through the hype, delivering hard-learned lessons and actionable insights gathered directly from the frontlines of enterprise AI deployment and incident response.
Moving past theoretical frameworks, this talk addresses the real-world friction points keeping leadership up at night: privilege creep, "black box" execution pathways, and the rise of shadow agent deployments by business units. Attendees will learn how organizations are successfully balancing innovation and risk, exploring practical strategies to safely enable these high-productivity tools without inadvertently opening a backdoor to enterprise data assets.
Key areas covered include:
- The Agentic Risk Landscape: A frontline analysis of the unique security, compliance, and operational risks introduced when autonomous agents are granted execution capabilities.
- The Governance Blueprint: Core pillars for establishing operational guardrails, creating cross-functional oversight, and integrating agentic threat modeling into existing enterprise risk management frameworks.
- Real-World Case Studies: Lessons learned from early enterprise deployments, highlighting both rapid business wins and overlooked security gaps that led to live incidents.
- Securing the Ecosystem: High-priority technical and procedural controls to secure the AI agent lifecycle without degrading model performance.read more
Jose ToledoPrincipal - Google
Ryan FriedPrincipal Security Consultant - Google
☆
Tue Aug 11 · 2:45 PM - 3:15 PM
The Rise of Agentic Fraud Ops: Fighting Fraud at Machine Speed
● Tech
📍 AI Risk Summit Tech Track (Salon II)
AI has fundamentally broken trust on the internet, and the numbers prove it. With AI-driven fraud attacks up 311% in Q1 2026, synthetic IDs growing increasingly convincing, and deepfakes now indistinguishable from real video, fraudsters are operating at machine speed.AI has fundamentally broken trust on the internet, and the numbers prove it. With AI-driven fraud attacks up 311% in Q1 2026, synthetic IDs growing increasingly convincing, and deepfakes now indistinguishable from real video, fraudsters are operating at machine speed. Meanwhile, financial institutions are being asked to do more with less: flat budgets, frozen headcount, and every tool under scrutiny.
In this session, Sardine founder and CEO Soups Ranjan makes the case that the only way to fight AI fraud is with AI, and lays out a practical blueprint for redesigning fraud operations around agentic workflows. Drawing on real attack scenarios, including a February 2026 case where 150K+ fraudulent accounts were created using stolen identities, Soups demonstrates how a coordinated chain of specialized AI agents, including anomaly detection, data analysis, graph analysis, and rule generation, can compress a week of data science work into five minutes.
Attendees will leave with a clear framework for getting their data AI-ready, identifying the right first use cases, and building agentic pipelines that let lean fraud teams punch far above their weight.read more
Securing AI Systems Through LLM Red Teaming: A Practical Pillar of Modern AI Governance
● Strategy
📍 AI Risk Summit Strategy Track (Salon I)
As large language models and other advanced AI systems transition from experimentation into mission-critical environments, traditional security and compliance controls are no longer sufficient to address their unique risk profile.As large language models and other advanced AI systems transition from experimentation into mission-critical environments, traditional security and compliance controls are no longer sufficient to address their unique risk profile. AI systems introduce new attack surfaces, including prompt injection, data leakage, model manipulation, and unpredictable outputs, requiring organizations to rethink how security and governance are operationalized.
This session presents a structured, practice-driven approach to securing AI systems through large language model red teaming as a core component of AI governance. The session is organized into three progressive modules: (1) foundational concepts and threat modeling for AI systems, (2) hands-on red teaming techniques, and (3) governance integration and operationalization. Participants will be introduced to established frameworks such as the NIST AI Risk Management Framework (MAP, MEASURE, MANAGE) and the OWASP Top 10 for LLMs to guide risk identification and testing strategies.
The practical component highlights specific techniques and tools used in LLM red teaming, including adversarial prompt design, jailbreak testing, and output evaluation using tools such as GARAK and DeepEval. Attendees will learn how to map testing activities to real-world risks such as sensitive information disclosure, model hallucination, bias, and system misuse. The session also demonstrates how red teaming outputs can be systematically documented and integrated into AI risk registers, impact assessments, and governance artifacts.
By positioning LLM red teaming as both a technical security function and a governance control, this session provides a repeatable methodology for embedding continuous testing into the AI lifecycle. Participants will leave with a clear understanding of how to structure red teaming efforts, select appropriate tools, and translate findings into actionable governance decisions that support safe, ethical, and resilient AI deployment.read more
Kellep CharlesCybersecurity Department Chair - Capitol Technology University
☆
Tue Aug 11 · 3:30 PM - 4:00 PM
What 2 Trillion AI Tokens Reveal About Hidden AI Agent Security Risk
● Tech
📍 AI Risk Summit Tech Track (Salon II)
TELUS is Canada's leading telecom provider and a global leader in contact center BPO, content moderation, digital transformation, and AI model training. In 2025 alone, TELUS generated more than two trillion AI tokens across 100+ production use cases.TELUS is Canada's leading telecom provider and a global leader in contact center BPO, content moderation, digital transformation, and AI model training. In 2025 alone, TELUS generated more than two trillion AI tokens across 100+ production use cases. That scale exposed a hard truth: the vulnerabilities hiding inside AI systems are far more common, and far more dangerous, than most security teams realize. So why does AI security testing still miss them, and where are the blind spots?
This session breaks down where manual and automated testing fall short, including why off-the-shelf and fine-tuned models produce weak attack simulations that leave real exposure undetected. We'll show how these gaps widen when moving from generative AI applications that deliver information to AI agents that take action, and why testing built for yesterday's risk can't keep pace with today's. It's grounded in current academic research and real-world testing of large-scale AI production systems.
CISOs and AppSec leaders will leave able to spot vulnerabilities faster, evaluate testing solutions more critically, and manage exposure introduced by the latest AI capabilities before they become the next hack or headline.read more
Bret KinsellaSr VP & General Manager - TELUS Digital
☆
Tue Aug 11 · 3:30 PM - 4:00 PM
Why Responsible AI is a Hard Data Engineering Problem (Not a Legal Checklist)
● CISO Forum
📍 CISO Forum Track (Salon III)
While enterprise leaders are eager to unlock the velocity of generative AI and autonomous agents, deployment frequently stalls at the governance layer due to concerns over data hallucinations, compliance risk, and unverified automated actions.While enterprise leaders are eager to unlock the velocity of generative AI and autonomous agents, deployment frequently stalls at the governance layer due to concerns over data hallucinations, compliance risk, and unverified automated actions. The industry has spent significant cycles treating "Responsible AI" as an abstract ethical policy. In a production B2B environment, it is fundamentally an infrastructure architecture challenge.
This session bypasses the high-level policy hype to deliver a battle-tested, vendor-neutral blueprint for building deterministic validation and risk mitigation frameworks directly into the enterprise data layer.read more
Shruti AnandProduct Lead Dev AI - Google
Built for you by(617)-PATRICK, Champion AI speaker
[Panel] Beyond Compliance: Who Owns, Measures, and Engineers Resilience in the AI Enterprise?
● CISO Forum
📍 CISO Forum Track (Salon III)
Patching, compliance, and AI adoption metrics may demonstrate activity, but they do not
necessarily prove that an organization is secure, resilient, or receiving meaningful value from its technology investments.Patching, compliance, and AI adoption metrics may demonstrate activity, but they do not
necessarily prove that an organization is secure, resilient, or receiving meaningful value from its technology investments. This panel will examine how CISOs can move toward continuous
security engineering, control validation, secure-by-design practices, recovery testing, and
measurable operational resilience as technologies, threats, and dependencies continue to change.
Panelists will also discuss how responsibility for AI risk should be divided across the CISO,
CIO, Chief AI Officer, legal, compliance, data governance, and business leadership. The
conversation will focus on who can approve or stop AI-enabled deployments, how residual risk
should be accepted, and which metrics best demonstrate control effectiveness, AI asset visibility, human oversight, fallback readiness, provider concentration, and return on investment.read more
☆
Tue Aug 11 · 4:05 PM - 5:00 PM
[Panel] The Guardrail Paradox: Why the Most Secure AI Deployments Move the Fastest
● Tech
📍 AI Risk Summit Tech Track (Salon II)
Conventional wisdom says security slows AI down. This panel argues the exact opposite: enterprises that establish proactive "governed guardrails" from day one avoid the friction of "shadow AI," costly rework, and stalled rollouts.Conventional wisdom says security slows AI down. This panel argues the exact opposite: enterprises that establish proactive "governed guardrails" from day one avoid the friction of "shadow AI," costly rework, and stalled rollouts. True velocity occurs when security and technology platforms are paired with a strong "human firewall" where every employee is accountable for security and fully fluent in AI.
Join Alvina Antar, Chief Digital Officer at F5, as she moderates a dynamic session with industry leaders who are actively scaling enterprise AI. Learn how they navigate hybrid infrastructure, balance data sovereignty, and empower their workforce to be fearless—yet secure—innovators.read more
Alvina AntarChief Digital Officer - F5
Awinash SinhaChief Digital & Information Officer - Zoom
Balancing Innovation and Control: How to Scale AI Safely Across the Enterprise.
● CISO Forum
📍 CISO Forum Track (Salon III)
As organizations scale AI rapidly, the challenge is no longer adoption—but managing risk without slowing innovation.As organizations scale AI rapidly, the challenge is no longer adoption—but managing risk without slowing innovation. This session explores how to embed governance, accountability, and practical guardrails into the AI lifecycle, enabling leaders to accelerate value creation while maintaining trust, compliance, and resilience. It will highlight practical concepts from operational risk lens, including risk-based use case tiering, clear ownership and human-in-the-loop controls, and embedding governance across the AI lifecycle to ensure transparency, accountability, and rapid intervention when needed. Attendees will gain actionable guidance on operationalizing AI governance to accelerate value creation while maintaining trust, compliance, and enterprise resilience.read more
Anna LoshkarevaRisk Officer Digital - Navy Federal Credit Union
☆
Wed Aug 12 · 9:00 AM - 9:35 AM
Ignore Previous Instructions: Offensive Intelligence for the AI Era
● Tech
📍 AI Risk Summit Tech Track (Salon II)
We keep trying to secure AI the same way we secure software, and that assumption is already costing us. Modern AI systems don't behave like traditional applications.We keep trying to secure AI the same way we secure software, and that assumption is already costing us.
Modern AI systems don't behave like traditional applications. They write code, call tools, chain decisions, and interact with the world with increasing autonomy -- and most organizations are still spending their time trying to control what the model says. That's not where the bodies are buried.
David Campbell spent three years red teaming AI systems across enterprise and government environments, and the same pattern shows up every time. The interesting failures aren't in the model. They emerge in everything built around it.
These systems expose a different kind of attack surface: agents with delegated authority, tool sprawl across environments, workflows that drift from read to action, memory and context that outlast any single session. This talk walks through how those surfaces get exploited.
We'll look at real adversarial scenarios. How a benign prompt that becomes an action chain, a low-privilege interaction that escalates through tool access, an agent that routes around intended controls without touching a traditional vulnerability, "allowed behavior" that becomes the attack path.
To make sense of why this keeps happening, Campbell uses a simple frame: behavior, identity, and control. The industry is obsessed with behavior. Attackers aren't. They're going after authority and the absence of meaningful control around it.
What that produces is a class of systems that don't need to be broken in order to be exploited. They only need to be used as designed.
'Ignore previous instructions: Embracing AI Red Teaming' was so three years ago, this is a talk about how AI systems actually get hacked.read more
David CampbellHead of AI Security - Scale AI
☆
Wed Aug 12 · 9:00 AM - 9:35 AM
Morning Keynote
● Strategy
📍 AI Risk Summit Strategy Track (Salon I)
SecurityWeek Speakers
Built for you by(617)-PATRICK, Champion AI speaker
Breaking the Sound Barrier: End-to-End Red Teaming for AI Voice Agents
● Strategy
📍 AI Risk Summit Strategy Track (Salon I)
AI voice agents are a lot like their text-based counterparts. Helpful, deliberate, and vulnerable. As voice becomes a more prominent modality for user interaction and enterprise product capabilities, safety and security testing lags far behind.AI voice agents are a lot like their text-based counterparts. Helpful, deliberate, and vulnerable. As voice becomes a more prominent modality for user interaction and enterprise product capabilities, safety and security testing lags far behind. Voice introduces novel attack surfaces and the practical challenges of automating audio make it difficult to efficiently scale testing.
Voice agents built on speech-to-text pipelines inherit the vulnerabilities of their text-based counterparts, but introduce new attack surfaces at the transcription layer: acoustic adversarial inputs, prosody manipulation, and exploitable gaps between what a human hears and what the system transcribes. Native audio models present a different risk profile, processing speech without an intermediate text representation and creating attack vectors at the layer of sound.
Automating voice agent testing is practically harder than text. Full pipeline testing requires generating adversarial audio inputs programmatically, handling spoken latency and interruptions, and achieving meaningful coverage across languages and dialects. These challenges contribute to an immature safety and security landscape across a quickly emerging modality.
Attendees will leave with an understanding of the voice agent risk landscape, how attackers approach reconnaissance and exploitation, and practical guidance for building safety and security audio testing programs that scale.read more
Matt FiedlerSr. Product Manager, AI Agent Security - Check Point
☆
Wed Aug 12 · 9:35 AM - 10:10 AM
Governing the Intelligent Enterprise: AI Risk Management Frameworks for Production Systems
● CISO Forum
📍 CISO Forum Track (Salon III)
AI systems are failing faster than governance can keep up. Documented AI safety incidents surged 56.4% in recent years, with hallucination rates nearly doubling and autonomous agents executing unintended real-world transactions.AI systems are failing faster than governance can keep up. Documented AI safety incidents surged 56.4% in recent years, with hallucination rates nearly doubling and autonomous agents executing unintended real-world transactions. For AI engineers shipping production systems at scale, the question is no longer whether to implement risk management, but which frameworks actually work when things go wrong.
This talk examines the operational reality of AI risk governance through the lens of the NIST AI Risk Management Framework and its ecosystem: the EU AI Act (enforceable August 2026), ISO/IEC 42001 certification standards, and NIST AI 600-1's 12 generative AI-specific risk categories. Unlike theoretical discussions of "responsible AI," this session focuses on what production teams actually need: inventory systems for AI components, monitoring architectures that catch drift before it becomes disaster, and accountability structures that survive real incidents.
You'll learn the four-function GOVERN-MAP-MEASURE-MANAGE cycle that applies across the AI lifecycle, how to instrument AI systems for continuous monitoring, and why organizations with documented governance infrastructure respond to failures 10x faster than those operating without it. We'll cover practical implementation patterns for managing third-party model risks, red-team evaluation protocols that find vulnerabilities before adversaries do, and the emerging insurance and procurement requirements that are making governance a competitive differentiation.
This isn't compliance theater. When AI systems execute millions of decisions daily - approving loans, routing patients, generating customer-facing content, traditional human-in-the-loop review cannot scale. The gap between capability deployment and risk infrastructure is widening, not closing. Organizations that embed governance into AI design earn the trust that converts capability into sustained advantage. Those that don't are building liability at scale.
Expect tactical guidance on building AI risk management flywheels, navigating multi-framework compliance across jurisdictions, and translating voluntary standards into engineering requirements before regulators mandate them. Whether you're deploying foundation models, building agentic systems, or integrating AI into critical infrastructure, you'll leave with a practical roadmap for governing AI systems that cannot afford to fail.
Key Takeaways:
- The NIST AI RMF four-function architecture and how to implement it in production environments
- NIST AI600-1's 12 AI-specific risks and mitigation actions engineers can deploy now
- Monitoring strategies for detecting model drift, bias, and adversarial exploitation
- Building incident response capabilities before the first material AI failure
- Why organizations treating governance as optional are making an increasingly poor regulatory timing bet
For AI/ML engineers, engineering leads, architects, and CxOs responsible for production AI systems.read more
Sanjeev SharmaField CTO - StackGen
☆
Wed Aug 12 · 9:35 AM - 10:10 AM
What did the AI Tool Actually Log?
● Tech
📍 AI Risk Summit Tech Track (Salon II)
Someone on your security team will eventually have to investigate an AI agent. Maybe it accessed a sensitive file, ran an unexpected command, changed a repository, or called a connected system.Someone on your security team will eventually have to investigate an AI agent. Maybe it accessed a sensitive file, ran an unexpected command, changed a repository, or called a connected system. The first question will be simple: what did the tool actually log? The answer will not be. One product records prompts and tool decisions. Another records only the policy change that allowed the action. A third proves that a feature was used while omitting the prompt, resource, and result.
This session maps the evidence boundary across today’s AI tooling. We will separate runtime telemetry from administrative audit logs and feature-usage records, then show what each evidence class can establish on its own. We will examine the identifiers that make investigations possible, the blind spots that detections inherit, and where endpoint, identity, network, Git, CI/CD, and SaaS telemetry must fill the gaps. We will also cover the collection, parsing, retention, and privacy decisions that determine whether these records are useful when an incident occurs.
Come if your organization is deploying AI tools faster than your security team can instrument them. You will leave with a practical model for deciding which records to collect, which questions they can answer, and where your current visibility ends.read more
AI-Generated Media in the Wild: Risks, Failures, and Mitigations
● CISO Forum
📍 CISO Forum Track (Salon III)
As generative AI systems evolve from text to image and video, the nature of risk is shifting - becoming more complex, harder to detect, and increasingly impactful at scale.As generative AI systems evolve from text to image and video, the nature of risk is shifting - becoming more complex, harder to detect, and increasingly impactful at scale.
In this session, I’ll share practical insights from building and deploying AI media safety systems at Meta, with a focus on how risks in generative systems are discovered, evaluated, and mitigated in real-world environments.
We’ll cover:
1. Risk discovery in generative media systems - identifying failure modes across images and video, including adversarial prompts and edge cases
2. Post-training alignment techniques, including reinforcement learning approaches to reduce harmful outputs
3. Automated red-teaming pipelines for systematically uncovering visual and temporal risks before deployment
4. Multimodal safety classifiers that balance risk reduction with usability (minimizing false positives and unnecessary refusals)
5. Scaling evaluation frameworks to increase testing coverage and iteration speed
6. Operationalizing safety through automation, including content risk labeling systems that significantly reduce manual effort and cost
This talk is intended for engineers, researchers, and practitioners working on deploying AI systems responsibly. The goal is to provide concrete patterns for identifying, measuring, and mitigating risk in modern AI systems - especially those operating at scale in real-world environments.read more
Ksheeraj VepuriSenior Research Engineer - Meta
Sourabh KulkarniResearch Scientist - Meta Platforms
☆
Wed Aug 12 · 10:10 AM - 10:40 AM
Allow? [Y/N] The Hidden Risks of AI Coding Tools — and the Button we Keep Clicking
● Tech
📍 AI Risk Summit Tech Track (Salon II)
AI coding assistants have become far more than autocomplete. Today's agents can read repositories, execute commands, install packages, access secrets, and push code—often with little human oversight. While they're transforming developer productivity, they're also introducing entirely new security risks.AI coding assistants have become far more than autocomplete. Today's agents can read repositories, execute commands, install packages, access secrets, and push code—often with little human oversight. While they're transforming developer productivity, they're also introducing entirely new security risks.
In this session, we'll break down the five biggest threats organizations face when adopting AI coding tools, from prompt injection and CI/CD compromise to malicious plugins, insecure AI-generated code, and the growing challenge of governing autonomous AI agents. Using real-world exploits and recent security research, we'll show how these attacks work, why they're succeeding, and what security and engineering leaders should do about them.
Attendees will leave with a practical framework for securing AI-assisted software development, reducing enterprise risk, and enabling developers to safely take advantage of the next generation of AI coding tools. (Presented by HiddenLayer)read more
Jacob RideoutCTO - HiddenLayer
☆
Wed Aug 12 · 10:10 AM - 10:40 AM
When Face Value Is Dead, How Do You Get to Truth?
● Strategy
📍 AI Risk Summit Strategy Track (Salon I)
AI has made it hard to know who is real. Even the world's most advanced AI companies are being penetrated by foreign operators, while criminal networks use deepfakes and synthetic identities to slip past existing controls.AI has made it hard to know who is real. Even the world's most advanced AI companies are being penetrated by foreign operators, while criminal networks use deepfakes and synthetic identities to slip past existing controls. Regulators are reacting with sweeping restrictions that continue to shift.
How bad is it, and how do you adjust without slowing down growth?
In this session, we'll show you the threat on a real-life heat map of international fraud rings, then you'll hear how leading companies are using the same identity layer trusted by the government to prove their guardrails are real.
Governments want to trust the private sector to innovate. Learn how to earn that trust now. (Presented by Socure)read more
AI Without Borders: The Collision of Regulation, Innovation, and Enterprise Reality
● CISO Forum
📍 CISO Forum Track (Salon III)
AI is evolving faster than any regulatory framework can keep up with, and organizations are caught between innovation pressure, unclear obligations, and real security risks that policy cannot yet address.AI is evolving faster than any regulatory framework can keep up with, and organizations are caught between innovation pressure, unclear obligations, and real security risks that policy cannot yet address. In this session, cybersecurity executive Joshua Copeland and GRC leader Kayla Williams break down the widening gap between regulation and reality. They explore what developers truly face on the ground, what AI security teams cannot technically enforce, and the gray zones where compliance becomes theater. Attendees will learn how to build AI governance that is practical, scalable, and aligned with real-world enterprise constraints without slowing innovation to a crawl.read more
Joshua CopelandDir of Cybersecurity - Crescendo
Kayla WilliamsCo-Founder/Principal - Williams Rose AI Cyber Advisory
☆
Wed Aug 12 · 11:00 AM - 11:30 AM
Agentic Infrastructure Risk: Securing Autonomous AI Systems in Production
● Strategy
📍 AI Risk Summit Strategy Track (Salon I)
AI systems are rapidly evolving from passive models into autonomous agents capable of executing complex workflows across APIs, services, and cloud infrastructure. While this unlocks unprecedented automation, it also introduces a new and largely unaddressed category of risk.AI systems are rapidly evolving from passive models into autonomous agents capable of executing complex workflows across APIs, services, and cloud infrastructure. While this unlocks unprecedented automation, it also introduces a new and largely unaddressed category of risk.
In this talk, we explore agentic infrastructure risk - the failure modes, security vulnerabilities, and operational hazards that emerge when AI systems are allowed to take real-world actions. Drawing from experience building large-scale infrastructure at Meta, we examine how agent runtimes interact with APIs, tools, and micro-services, and why traditional security and reliability models fail in non-deterministic systems.
We will analyze critical emerging risks, including hallucinated actions, cascading retries, privilege escalation through tool misuse, and unbounded execution loops that can trigger system-wide incidents or cost explosions. Unlike traditional software failures, these risks are amplified by autonomy and feedback loops.
The session will introduce practical mitigation strategies:
* Guardrail architectures and action validation pipelines
* Policy-driven execution controls and zero-trust action models
* Observability for reasoning-driven, non-deterministic systems
* Cost containment and runtime safety mechanisms
Attendees will leave with a concrete, production-ready blueprint for designing AI systems that are secure, observable, and governed by design - enabling organizations to deploy autonomous agents without compromising safety or control.
Key Takeaways
- Identify new classes of AI risk introduced by autonomous agents
- Understand how agent failures differ from traditional system failures
- Learn to design guardrails and zero-trust execution layers
- Build observability for decision-making systems
Apply cost, safety, and governance controls in productionread more
Nishant GuptaStaff Software Engineer, Tech Lead - Meta (Meta SuperIntelligence Lab)
☆
Wed Aug 12 · 11:00 AM - 11:30 AM
From Prompt to Breach: Memory Forensics in AI-Augmented Attack Surfaces
● Tech
📍 AI Risk Summit Tech Track (Salon II)
AI-augmented applications are redefining the attack surface, from prompt injection in LLMs to memory-resident payloads that blur the lines between inference and intrusion.AI-augmented applications are redefining the attack surface, from prompt injection in LLMs to memory-resident payloads that blur the lines between inference and intrusion. This session examines real-world case studies where generative AI systems were exploited and how memory forensics plays a pivotal role in uncovering volatile threats. We’ll walk through advanced techniques for detecting and analyzing malicious behavior in memory, especially where conventional logging fails, and offer a forward-facing look at what “threat surfaces” truly mean in a post-AI era.read more
As AI systems become more autonomous, the central risk is not that humans disappear from the process entirely, but that they remain “in the loop” while being pushed into the passenger seat.As AI systems become more autonomous, the central risk is not that humans disappear from the process entirely, but that they remain “in the loop” while being pushed into the passenger seat. They approve outputs they do not fully understand, rely on recommendations they cannot audit, and delegate decisions to agents whose reasoning and methods are only partially visible.
This creates a dangerous governance gap because an agent may summarize sensitive data, recommend policy changes, modify code, trigger workflows, or escalate access.
Keeping humans in the driver’s seat cannot become a checkbox exercise. Automation may be acceptable for low-risk tasks, but high-risk actions require stronger controls such as audit trails, mandatory escalation paths, constrained permissions, token usage restrictions, and kill-switch capabilities. The goal is to ensure that human authority remains operationally real while maintaining efficiency.
Attendees will leave with a practical way to evaluate whether their human-in-the-loop controls are meaningful or merely cosmetic.read more
Michael HowardCEO - Protegrity
☆
Wed Aug 12 · 11:30 AM - 12:00 PM
When AI Agents Become the Supply Chain: Hidden Control Planes in Agentic Systems
● Tech
📍 AI Risk Summit Tech Track (Salon II)
Agentic AI risk is no longer only prompt injection. Once assistants can read repositories, browse pages, load plugins, install dependencies, and call tools, the real security boundary moves into the control plane around the model.Agentic AI risk is no longer only prompt injection. Once assistants can read repositories, browse pages, load plugins, install dependencies, and call tools, the real security boundary moves into the control plane around the model.
This session maps that boundary through three concrete failure modes from recent research: repository instruction files that silently steer coding agents, marketplace skills and plugins that alter dependency installation, and agentic browser/runtime patterns where untrusted content becomes model context and tool execution.
Attendees will leave with a practical threat model for agentic systems: content ingestion, context translation, tool authority, dependency provenance, and runtime containment. The session will also cover defensive controls security leaders can apply now, including instruction provenance, allowlisted tools, permission gates, dependency-source enforcement, audit logs, and review workflows for agent behavior.
This is an educational, vendor-neutral session for CISOs, AppSec teams, AI platform owners, and developers adopting coding assistants or autonomous agents. The examples come from real research into agentic AI and AI coding-assistant behavior, but the talk focuses on repeatable risk patterns rather than any single product.
Learning objectives:
1. Recognize hidden instruction sources that can steer agent behavior.
2. Explain why agentic AI risk resembles supply-chain and control-plane security.
3. Identify practical controls that reduce the blast radius of AI agents in enterprise environments.read more
David AbutbulAI Security Researcher - Prompt Security, a SentinelOne company
The shift from AI tools to autonomous agents has outpaced our risk models. Enterprise environments face a sprawl of tool access where agents operate with a blast radius that moves at machine speed.The shift from AI tools to autonomous agents has outpaced our risk models. Enterprise environments face a sprawl of tool access where agents operate with a blast radius that moves at machine speed. This creates a disconnect between the permissions granted and the actual oversight required to manage those agents in production. The only way to manage the risks of AI at machine speed is with human-AI systems.
We will focus on "Context Based Control" policies that balance agentic permissions with situational measurement of the appropriateness of their actions. We will also address designing probabilistic systems, informed by rules and context, that help you balance human oversight and machine work.read more
Cal Al-DhubaibPrincipal Technologist, Cloud and AI - Rubrik
☆
Wed Aug 12 · 12:00 PM - 12:30 PM
The Good, the Sad and the Ugly: What Research Reveals About AI Safety and Security Gaps and Options
● CISO Forum
📍 CISO Forum Track (Salon III)
How can a CISO or risk officer be confident that their AI-enabled applications are safe and secure? TELUS Digital recently completed more than 650k adversarial tests on 34 leading AI models.How can a CISO or risk officer be confident that their AI-enabled applications are safe and secure?
TELUS Digital recently completed more than 650k adversarial tests on 34 leading AI models. We will talk about how the vendor, model size, country-of-origin, reasoning capabilities, openness, and other factors impact AI safety and security. Importantly, we will also discuss how that translates into what CISOs should focus on when evaluating AI apps, both before launch and in production.
We will also review our latest research around AI agent testing and the gaps in current practices that result in avoidable risk. And we will review a recent survey of CISOs regarding their AI safety and security practices, as well as data from testing AI-enabled applications that consume more than 2T AI tokens annually.
TELUS Digital's AI Research Labs have published extensive research on AI safety and security in technical journals and conferences, built AI models that have compromised every AI model they've encountered, and worked directly with CISOs on how to automate testing, validation, and auditing of the safety and security of AI-powered systems.
The goal of this talk will be to offer data-driven insights about actual AI risks seen in the field, techniques that make a difference in vulnerability discovery, and straightforward steps that telcos, airlines, healthcare providers, and financial services companies have taken to proactively reduce risk and instill confidence in their AI investments, without increasing the burden on CISO organizations.
The presentation will provide specific data, concrete examples, and specific recommendations, while avoiding generalizations.read more
Bret KinsellaSr VP & General Manager - TELUS Digital
☆
Wed Aug 12 · 12:00 PM - 12:30 PM
The Synthetic Insider: When Deepfakes and Autonomous AI Agents Collide Inside the Enterprise
● Tech
📍 AI Risk Summit Tech Track (Salon II)
The phishing email asking a CFO to wire funds is yesterday's problem. In 2026, the attacker doesn't email the CFO.The phishing email asking a CFO to wire funds is yesterday's problem. In 2026, the attacker doesn't email the CFO. They clone the CFO's voice, leave a voicemail for an AI assistant that has calendar access, payment approval permissions, and a helpful disposition, and the AI does the rest. No human in the loop. No malware on the endpoint. No anomaly the SOC was trained to catch.
This session is about the collision the security industry has not fully reckoned with yet: deepfakes and synthetic media on one side, autonomous AI agents with real enterprise privileges on the other, and the identity layer in the middle that was never designed for either.
Drawing on years of architecting large-scale enterprise AI systems and serving on NIST's AI Agent Security subcommittee, I'll walk through the new attack chain step by step. How a few minutes of LinkedIn video becomes a convincing voice clone. How that clone bypasses help-desk verification. How it manipulates an AI agent that trusts authenticated channels more than it trusts judgment. And how a single compromised agent then cascades into others through the trust relationships your teams have quietly been building all year.read more
Maulik BhattSenior Software Engineer - Amazon AWS
Built for you by(617)-PATRICK, Champion AI speaker
Serious, not Supernatural: Defending From Agents at Scale
● Strategy
📍 AI Risk Summit Strategy Track (Salon I)
An autonomous attack crossed company boundaries. Familiar failures in authority, isolation, credentials, shared state, and detection made it possible.An autonomous attack crossed company boundaries. Familiar failures in authority, isolation, credentials, shared state, and detection made it possible. This talk covers the basics of how irresponsible management of autonomous systems inside your boundary can lead to new forms of risk. We'll also talk about the controls you can place today that shift governance left to prevent this from ever being an issue for your enterprise.read more
Eno ReyesCTO and Co-Founder - Factory
☆
Wed Aug 12 · 1:30 PM - 2:05 PM
When AI Meets the Courtroom: Building Trustworthy AI Systems Through Legal and Technical Governance
● CISO Forum
📍 CISO Forum Track (Salon III)
As organizations race to embed AI into their products, platforms, and decision-making pipelines, a critical question often goes unanswered until it’s too late: what happens when AI systems fail, produce harmful outputs, or become the subject of litigation?As organizations race to embed AI into their products, platforms, and decision-making pipelines, a critical question often goes unanswered until it’s too late: what happens when AI systems fail, produce harmful outputs, or become the subject of litigation?
This session, led by Daniel B. Garrie—co-creator of the JAMS AI Dispute Resolution Rules, JAMS arbitrator, Harvard adjunct professor, and founder of Law & Forensics—bridges the gap between AI engineering and the legal frameworks now shaping how AI is built, deployed, and defended in court. Drawing on 20+ years at the intersection of law and computer science, and hands-on experience as a court-appointed expert in landmark technology cases (including In Re: Facebook), Daniel will walk attendees through the real-world legal risks that product teams, CTOs, and AI engineers face today.
Key takeaways include:
• AI in litigation: How courts are evaluating AI-generated evidence, model outputs, and synthetic media—and the technical standards emerging from these rulings.
• Dispute-ready architecture: Practical engineering decisions (logging, versioning, documentation) that protect AI products when disputes arise.
• The JAMS AI Rules framework: A first look at the dispute resolution rules purpose-built for AI conflicts—covering IP infringement, data privacy breaches, synthetic content misuse, and LLM-related trade secret claims.
• Governance as competitive advantage: How proactive AI governance (cybersecurity audits, compliance frameworks, board-level oversight) reduces risk and accelerates enterprise adoption.
Whether you’re building AI products, leading engineering teams, or advising executive stakeholders, this session delivers the practical legal and technical intelligence you need to ship AI that’s not only powerful—but defensible.read more
David CassCISO - Keyrock
☆
Wed Aug 12 · 1:30 PM - 2:05 PM
When Agents Go Rogue: A Threat Model and Defense Framework for Agentic AI Systems
● Tech
📍 AI Risk Summit Tech Track (Salon II)
As enterprises rush to deploy agentic AI systems — autonomous agents that plan, reason, and execute multi-step tasks across tools and APIs — the security community is confronting an entirely new threat landscape.As enterprises rush to deploy agentic AI systems — autonomous agents that plan, reason, and execute multi-step tasks across tools and APIs — the security community is confronting an entirely new threat landscape. Unlike traditional LLM deployments, agentic systems can take irreversible real-world actions, exfiltrate data through tool calls, and propagate attacks across integrated environments.
This talk presents a practitioner-built threat model for agentic AI, developed through hands-on work building and securing production agentic systems at Microsoft. Drawing on real-world deployment experience, I will introduce a structured taxonomy of agentic AI failure modes — from prompt injection through orchestration chains to privilege escalation via tool misuse — and map each to concrete, implementable defenses.
Key topics covered:
• Why existing LLM security frameworks (OWASP Top 10 for LLMs, MITRE ATLAS) are insufficient for agentic architectures
• A novel threat model covering agent memory poisoning, cross-agent trust exploitation, and tool-layer attacks
• Defense-in-depth patterns: identity-aware orchestration, agent sandboxing, guardrail design, and behavioral monitoring
• Case studies from production agentic deployments illustrating real attack surfaces and mitigations
Attendees will leave with a practical, immediately applicable framework for assessing and hardening their own agentic AI deployments — not theory, but battle-tested patterns from the field.
Learning Objectives:
1. Understand why agentic AI introduces fundamentally new security risks beyond traditional LLM threats
2. Apply a structured threat model to identify attack surfaces in their own agentic systems
3. Implement concrete defense patterns including agent sandboxing, identity-aware orchestration, and behavioral guardrailsread more
Vaishnavi GudurSenior Software Engineer - Microsoft
AI coding agents are being deployed behind sandboxes, egress allowlists, and scoped filesystem access - and enterprises are calling it contained.AI coding agents are being deployed behind sandboxes, egress allowlists, and scoped filesystem access - and enterprises are calling it contained. This session proves otherwise with three original attack chains, each starting from a single indirect prompt injection and ending with full secret exfiltration or arbitrary code execution.
The attacker has zero prior access. No credentials, no malware, no endpoint compromise. Just a crafted GitHub issue that the agent is configured to read. From there, the agent does the rest - hijacked step-by-step into working on the attacker's behalf through a technique we call agentjacking.
We show a responsibly disclosed zero-day that escapes Claude Desktop's network sandbox entirely. A technique that exfiltrates stolen API keys and source code through an allowlisted package registry, indistinguishable from normal developer traffic. And an MCP configuration hijack that rewrites the agent's own trust chain — turning a verified tool into an attacker-controlled execution channel that delivers remote code execution, persistent access, and full secret exfiltration from inside a "secured" environment.
Every action is legitimate. Every destination is allowlisted. Every control in the path sees nothing. The failure is structural - not a bug in any single component, but a broken assumption about what containment means when the thing you're containing can reason.
The session closes with a practical hardening framework mapped to agent autonomy levels, so attendees leave knowing which controls actually matter for their deployment model.
All vulnerabilities responsibly disclosed. Live demos included.read more
Barak SternbergCo-Founder & CEO - Tenet Security
☆
Wed Aug 12 · 2:10 PM - 2:40 PM
Federated Learning as AI Risk Infrastructure: The Aggregation Problem Enterprises Are Not Ready For
● Strategy
📍 AI Risk Summit Strategy Track (Salon I)
Every enterprise AI system has a data problem: the most valuable training data is also the most sensitive. Financial transactions, client communications, proprietary records centralizing this data to train models creates exactly the risk enterprises are trying to avoid.Every enterprise AI system has a data problem: the most valuable training data is also the most sensitive. Financial transactions, client communications, proprietary records centralizing this data to train models creates exactly the risk enterprises are trying to avoid. Federated learning offers a third path: train across distributed nodes without raw data ever leaving its origin. But federated learning in production introduces its own risk surface that most enterprise teams are unprepared for.
The deeper problem is aggregation. Current federated deployments assume that model update aggregation strategies can be fixed before training begins and held constant across all rounds. In practice this assumption breaks down. Early rounds over-communicate, later rounds under-communicate at precisely the phase where model integrity is most sensitive. The result is a federated system that is simultaneously privacy-preserving and fragile.
This session presents an adaptive aggregation framework developed through original research in communication-efficient federated learning, validated across multiple model scales, that dynamically selects aggregation strategies based on live training signals rather than static configuration. Attendees will leave with a clear framework for evaluating federated learning as an enterprise AI risk mitigation strategy, an understanding of the aggregation vulnerabilities unique to federated architectures, and practical guidance on the governance mechanisms that separate a robust federated deployment from a vulnerable one.read more
Jerry Adams FranklinAI/ML Research Consultant | Ex-Senior AI Engineer, DCG & Intel - Independent | Ex-Digital Currency Group & Intel Corporation
☆
Wed Aug 12 · 2:10 PM - 2:40 PM
The Accountability Gap: Why AI Governance Fails Before the Breach Occurs
● CISO Forum
📍 CISO Forum Track (Salon III)
The AI risk conversation in enterprise security is dominated by two categories of threat: external adversaries exploiting AI, and model-level failures such as bias, hallucination, and data leakage. Both are real.The AI risk conversation in enterprise security is dominated by two categories of threat: external adversaries exploiting AI, and model-level failures such as bias, hallucination, and data leakage. Both are real. Neither is the governance failure that causes the most damage in high-stakes project, program and portfolio environments.
The most consequential AI risk in organizations today is internal and organizational: no human in the workflow has clear, documented, enforceable accountability for verifying what the AI produced before it became a decision. By the time the error surfaces, it has already propagated through compliance documentation, resource allocations, or regulatory filings. The breach did not come from outside. It was built into the process from the start.
Dr. Tricia Diamond draws on her experience directing a $386 million ARPA Implementation PMO, where AI-assisted tools were deployed in a federally audited environment with zero tolerance for undetected error, to present a practitioner's framework for closing the accountability gap before it becomes a liability. This session examines the specific organizational conditions under which AI errors compound undetected, the human-in-the-loop validation architecture that actually works under operational pressure, and the documentation and traceability practices thatmake AI-assisted decisions defensible when the regulator or the auditor arrives.
This is not a theoretical framework. It is a field account of AI governance built and operated under real federal scrutiny, with real consequences for failure, in an environment where the cost of an undetected error was measured in potential clawback of public funds and community harm.
Learning Objectives are
Identify three organizational conditions that allow AI errors to compound undetected in enterprise environments, and the governance interventions that interrupt each one before they become a security or compliance event.
Design human-in-the-loop validation checkpoints that function under operational pressure rather than creating the appearance of oversight while the process moves too fast for genuine verification.
Build the documentation and traceability architecture that makes AI-assisted decisions auditable, defensible, and correctable after the fact by satisfying both internal risk management requirements and external regulatory scrutiny.read more
Tricia DiamondFounder and Director - Diamond PMO Solutions
Built for you by(617)-PATRICK, Champion AI speaker
License to Govern: The Field Guide for AI Risk Management
● Strategy
📍 AI Risk Summit Strategy Track (Salon I)
Every organization strives to build a James Bond security program. Sophisticated. Equipped. Ready for catch villains as soon as they break in. The problem: today's threats don't break in. They already have a badge.Every organization strives to build a James Bond security program. Sophisticated. Equipped. Ready for catch villains as soon as they break in.
The problem: today's threats don't break in. They already have a badge. They were credentialed by your own people, with good intentions, but without the knowledge or approval of the security team. Today’s threats look exactly like allies until they don’t.
Through real breach stories from Salesloft Drift, Vercel, and Klue, this session illustrates how AI adoption is reshaping third party risk. The organizations who invest now in modernizing their approach to risk management will be in a much different place in 18 months than those who don’t.read more
Patrick DillonCRO - Nudge Security
☆
Wed Aug 12 · 2:45 PM - 3:15 PM
Securing AI: From Guardrails to the Enterprise Control Plane
● Tech
📍 AI Risk Summit Tech Track (Salon II)
AI has moved fast and so has the magnitude of your worst day.AI has moved fast and so has the magnitude of your worst day. In just 12 to 24 months, enterprise AI has evolved from individual experimentation into the early era of autonomous, agentic systems running across endpoints, cloud, and data center. That shift has expanded the security conversation from a narrow guardrails problem into something far broader: discovering where AI lives, understanding agent intent and actions, and unifying it all under a common control plane.
This session traces that journey, covering where we have been, what we have today, and where we are headed. We will start by framing how the AI risk landscape has changed and why traditional tools fail against non-deterministic, machine-speed systems. From there, we will walk through how AI security platforms are evolving with AI discovery as the essential starting point and how AI security testing and runtime controls must be intertwined. We will close with a look ahead at how AI Gateways are becoming the enterprise control layer, and how governing model routing, token usage, and agent behavior across the organization will become future table stakes for AI risk leaders. (Presented by F5)read more
Mani GanesanVP of Product Management - F5
☆
Wed Aug 12 · 2:45 PM - 3:15 PM
Why Fragmented AI Policy is Fueling Public Skepticism — and What Security Leaders Can Do About It
● CISO Forum
📍 CISO Forum Track (Salon III)
The trust gap in AI is real, and possibly expanding.The trust gap in AI is real, and possibly expanding. A 2025 Pew Research Center study found that while a majority of AI experts believe AI will have a positive impact on the United States, only 17% of the American public agrees. More than half of U.S. adults say they are more concerned than excited about AI, and both the public and experts alike indicate concern that government regulation will fall short rather than go too far.
AI governance is evolving, but not always in the same direction. Across the United States, states are writing their own AI rules in the absence of federal law. Internationally, a growing number of countries are each charting distinct regulatory paths. The result is a “patchwork” landscape that is active, ambitious, and complex to navigate from a compliance standpoint, which can send mixed signals to a public already uncertain about whether AI is being governed responsibly.
That perception challenge has real consequences. Public uncertainty about AI can slow adoption and create friction for organizations trying to deploy AI thoughtfully and at scale. For security and business leaders, trust is increasingly part of the AI risk calculus.
This session explores the relationship between policy fragmentation and public confidence in AI, and makes the case that today's regulatory complexity can also be viewed as an opportunity. Leaders who understand the policy landscape, and can translate it clearly for their organizations and stakeholders, are uniquely positioned to help close the gap.
Drawing on firsthand experience navigating the AI policy and regulatory landscape across federal, state, and international jurisdictions, this talk will map the current AI regulatory trends for a security-literate audience, connect it to enterprise risk in practical terms, and offer a framework for turning policy complexity into a trust-building advantage.read more
Bethany AbbateDir, AI Policy - Software & Information Industry Association (SIIA)
Rethinking How we Evaluate Security Agents for Real-World Use
● Tech
📍 AI Risk Summit Tech Track (Salon II)
Security agents are gaining momentum across industry, but the way we evaluate them remains rooted in narrow, outcome-only benchmarks.Security agents are gaining momentum across industry, but the way we evaluate them remains rooted in narrow, outcome-only benchmarks. These evaluations tell us whether an agent produced a correct answer, but not “how” it arrived there or whether that behavior will remain stable once deployed.
In practice, enterprise security is not a sequence of isolated tasks. It is a connected, end-to-end workflow that follows a find → confirm exploit → patch → validate loop. Agents that perform well on task-specific benchmarks often fail in these multi-stage settings due to contextual loss and brittle transitions across steps.
This talk introduces a practical framework for evaluating security agents by mapping agentic capabilities (planning, reasoning, memory, perception, tool use) to security functions (reconnaissance, exploit confirmation, root-cause analysis, patching, validation) across the full lifecycle.
We also share insights from our large-scale survey of existing agentic systems and presents a lightweight, unified end-to-end scoring perspective that teams can use to assess an agent’s readiness for real operational environments.read more
Mudita KhuranaStaff Security Engineer - Airbnb
☆
Wed Aug 12 · 3:30 PM - 4:00 PM
The Defender's Window
● Strategy
📍 AI Risk Summit Strategy Track (Salon I)
The dynamics of AI and cyber security have reached a structural inflection point. The 3 dynamics between AI and cyber security with which we are concerned are as follows.The dynamics of AI and cyber security have reached a structural inflection point.
The 3 dynamics between AI and cyber security with which we are concerned are as follows. These are the axes of the strategic space of LLMs and cyber security:
• LLM enabled capability uplift at the lower end of the attacker capability spectrum – Attacker capability uplift determines the change in threat population that your organisation faces
• Ability to leverage LLMs for analytical capability for defenders – What can your organization do with the infrastructure you have?
• Tiered access governance for LLM cybersecurity capability – What tier of defensive capability can your organization reach?
The three tiers of access governance for LLM cybersecurity capability are currently:
• Glasswing - Closed to all but fifty firms (roughly).
• TAC - Open to thousands of verified defenders, the one most peers will likely operate in.
• Public models and open-source agent frameworks - Public research has found that with the right expertise this tier may well be much closer to the top tier than the hype suggests.
Together, the dynamics produce the window - The time-bounded period during which the access-governance advantage is real, the analytical leverage is being built, and the capability uplift at the lower attacker tier is still being absorbed rather than exploited at full tilt.
We analyze the threat to and from AI implementations under the COMPASS framework - Compute, Operations, Models, Power and utilities, Alliances, and Supply Signals.
We assess the AI derived problems facing organizations and their technology stacks, detailing what those problems are, why they matter, and what can be done about them.
Attendees to this session will leave with an elevated understanding of the current AI situation from a cybersecurity governance and opportunity perspective.read more
Stephen RobinsonLead Threat Intelligence Researcher - LRQA
☆
Wed Aug 12 · 3:30 PM - 4:00 PM
The EU AI Act Takes Effect This Year. Your Explainability Tools Aren't Ready.
● CISO Forum
📍 CISO Forum Track (Salon III)
Article 13 of the EU AI Act requires high-risk AI systems to produce interpretable, documented explanations of their decisions. Those requirements take effect in August 2026—just days after this summit. The Colorado AI Act follows in June.Article 13 of the EU AI Act requires high-risk AI systems to produce interpretable, documented explanations of their decisions. Those requirements take effect in August 2026—just days after this summit. The Colorado AI Act follows in June.
Most organizations plan to meet these requirements using SHAP, particularly KernelSHAP, the leading model-agnostic approach for black-box models. The problem is that KernelSHAP relies on permutation sampling, meaning it can generate different explanations for the same input every time it runs.
That creates a critical compliance question: How do you submit a non-reproducible audit trail to a regulator?
While TreeSHAP is deterministic, it only works for tree-based models and doesn't solve the broader problem.
This session introduces four deterministic, model-agnostic methods designed to address that gap:
Interaction Mapping – Detects feature synergy and redundancy.
Counterfactual Pathing – Identifies the minimal sequence of changes needed to flip a decision.
Reasoning Drift Tracking – Measures how model reasoning changes over time using Jensen-Shannon divergence.
Deterministic Reproducibility – Produces identical explanations without stochastic sampling.
All four methods are gradient-free, run in O(n) time, and execute entirely in the browser with no backend.
Attendees will see live demonstrations of each technique, learn what Article 13 actually requires, why current explainability tools fall short of auditability standards, and what a regulation-ready explanation artifact should look like.
Designed for risk leaders, compliance teams, and AI engineers building AI systems for regulated industries, this session provides practical guidance for ensuring explainability pipelines can withstand regulatory scrutiny.read more
Tested, Trusted, and Verifiable: Maintaining AI Assurance in the Synthetic Enterprise
● Tech
📍 AI Risk Summit Tech Track (Salon II)
AI systems can change through model updates, new data sources, altered prompts, expanded
permissions, and shifting operational environments, meaning a system that was considered safe at deployment may behave differently over time.AI systems can change through model updates, new data sources, altered prompts, expanded
permissions, and shifting operational environments, meaning a system that was considered safe at deployment may behave differently over time. This panel will examine how organizations can apply continuous assurance through ongoing testing, behavioral monitoring, red teaming, drift detection, evidence validation, and clearly defined triggers for reassessment or reauthorization.
Panelists will also explore how organizations can preserve trust in the records and evidence these systems produce. The discussion will address authenticity, chain of custody, AI-generated
reports and summaries, manipulated media, synthetic records, and the challenge of proving what occurred when legitimate evidence can be altered, fabricated, or dismissed as artificial.read more
☆
Wed Aug 12 · 4:00 PM - 5:00 PM
[Panel] AI Dependency Threshold: Building a Smarter Workforce Without Creating Operational Fragility
● CISO Forum
📍 CISO Forum Track (Salon III)
AI is rapidly changing how employees research, write, analyze, code, communicate, and make decisions.AI is rapidly changing how employees research, write, analyze, code, communicate, and make decisions. While these tools can improve productivity and expand workforce capabilities, they may also weaken critical thinking, reduce knowledge retention, and create dependence on systems employees may not fully understand.
This panel will examine how organizations can build AI fluency without sacrificing human
judgment, foundational skills, or operational resilience. Panelists will discuss how leaders can recognize when automation has crossed from productive augmentation into excessive dependency, including the risks of reduced oversight, provider concentration, limited fallback capabilities, and an inability to operate effectively when AI systems are unavailable.read more
Dan LohrmannField CISO, Public Sector - Presidio
🤖 Let AI help you determine which sessions to attend
Download the full session list and paste it into Claude (claude.ai).
Then paste a prompt like the example below — it gives the AI a role, context about the data, and a clear task.
Tip: This is a large session list. Claude (claude.ai) handles the full file reliably. Other tools like ChatGPT and Gemini may silently cut off the data — the verification step in the prompt will catch that.
Example prompt:
ROLE: Expert conference advisor for AI Risk Summit 2026 attendees CONTEXT: I'm pasting over 50 sessions for the AI Risk Summit 2026.
I am a security leader responsible for AI risk. I want practical sessions on securing AI systems, governance and compliance, and the chance to compare notes with other CISOs. GOAL: Pick the top 10 sessions for me. OUTPUT FORMAT: List in chronological order. Do NOT number them sequentially.
Instead, start each entry with its relevance rank in bold, like: Rank #3 of over 50 — Session Title.
Follow with the day and time, then 2-3 sentences on why it fits my goals. VERIFICATION: Before answering, confirm how many sessions you received.
You should have at least 50. If you received significantly fewer,
tell me immediately — my paste was probably truncated.
😎 How cool am I? 😎
Which sessions are right for you?
Describe yourself and what you want out of AI Risk Summit 2026. The more specific you are, the better this works.
You can also say how many you want or when you're free — “just my top 3”, “give me 20”, “only Friday afternoon”. You get 10 unless you ask for more.
There's a daily limit on this instant version, so it stays free for everyone at the event. Want to run it as many times as you like? Scroll down, tap Copy prompt, and paste it into Claude or ChatGPT at home — same session list, no cap.
Powered by Claude. Your text is sent to Anthropic to generate the ranking, and is logged on this site so the feature can be improved. Please don't type anything confidential.
×
Schedule Builder v66 Schedule data captured August 12, 2026
