This half-day virtual seminar takes the offensive threat as its starting point and works forward: what does realistic modern attacker capability look like today, how should it reshape defender priorities, and what does it mean for the tools, workflows, and assumptions we've relied on? A leadership panel will kick off the event and be followed by four focused sessions on vulnerability management, harnesses, attacker automation, and agentic detection.
December 3, 2026 | 8:00 AM PT | 11:00 AM ET Virtual Seminars
PART 1: Leadership Panel: The Post-Mythos Threat Model: What We Got Right, What We Got Wrong
Eight months after Mythos, CISOs have real data from the patch storms, the board questions, and the disclosure waves. This panel will go beyond what has happened in 2026 in order to plan for what’s next. Security leaders will compare notes on eight months of consensus, exploring what held, what didn't, and how organizations should be positioning now as the disclosure pipeline accelerates into 2027.
Moderator: Sezaneh Seymour, VP & Head, Regulatory Risk & Policy, Coalition Inc.
Panelists: Alex Hutton, Senior Vice President, Emerging Threat Defense, Bank of America; Susan Koski, Executive Vice President, Chief Information Security Officer, PNC Financial Services; Robert Lee, CEO & Founder, Dragos, Inc. and SANS Institute Fellow
PART 2: Traditional Sessions
Session 1: Rethinking Vuln Management for an Automated Threat Landscape
AI-driven vulnerability discovery has broken the assumptions underlying most patch and vuln management programs. Drawing on product security practice, this session will not only cover what to stop doing but will also examine how chainability-aware prioritization, reachability analysis, and architectural chokepoints change the calculus.
Speaker: Lisa Bradley, PhD, Senior Director, Product & Application Security, Dell Technologies
Session 2: Harnesses: The New Offensive-Defensive Frontier
Harnesses exist on both sides of the line—offensive ones are commoditizing, defensive ones are being built in-house. This session will cover what they are, where they sit in the security model, whether they can or should be shared and gated, and what commoditization means for the defender poverty line. This session will address the STIX/TAXII equivalent for harnesses, whether defenders can gate proprietary harnesses in an open-weight world, and what happens when offensive harnesses become a commodity.
Speaker: Niels Provos
Session 3: The Linear Trap: Dynamic Incident Response Against Automated Attackers
Attackers have rebuilt their tradecraft around automation, and breakout times once measured in days are now measured in minutes. Defenders still respond with linear models designed almost forty years ago. Presented from the perspective of an attacker at heart and a defender by necessity, this session will examine why stepped response models fail against automated adversaries, then introduces the Dynamic Approach to Incident Response (DAIR): a model built on waypoints and an iterative response loop that matches the attacker's tempo.
Speaker: Joshua Wright, Faculty Fellow and Senior Technical Director, SANS Institute and Counter Hack Innovations
Session 4: Next-Gen IDS: Integrating Agentic AI with Open-Source Detection
Modern IDS/IPS systems face evolving challenges: zero-day attacks, encrypted traffic, and alert fatigue. This session explores integrating AI and agentic systems with open-source intrusion detection platforms. Learn how neural networks detect novel exploits, how LLM-powered agents automate threat analysis, and practical architectures for autonomous response. Each defensive layer is paired with the attacker's view of it, covering how an adversary evades the ML classifier, poisons the model retraining loop, and turns automated response into a denial-of-service tool.
Speaker: Samaresh Kumar Singh, Principal Engineer, HP Inc.
This virtual seminar is sponsored by Wiz. Wiz transforms cloud security for customers with an operating model built to automate risk reduction and threat response, enabling security teams to operate at AI speed.