Examples

In 2026, agentic AI will challenge our legacy risk models. This leadership panel will unite experts from government, AI model developer, and open standard to cover the value of an open standard like OWASP AIVSS to be used as one of the foundational frameworks for Agentic AI Risk Management. Attendees will gain strategic insights on building trust and managing enterprise risk in the age of Agentic AI.

In 2026, the deployment of agentic AI is a standard business practice, but our methods for managing its unique risks are not. Legacy risk frameworks are insufficient for governing autonomous systems that can learn, adapt, and develop emergent behaviors. This creates a critical blind spot for enterprise leaders and national security stakeholders alike. This panel addresses this governance gap head-on, addressing the "what, why, and how" of measuring agentic AI risk at a strategic level:

Defining the New Risk Landscape (What): Expanding on why agentic AI demands a shift from a code-centric security view to a semantic-centric governance model. How to measure the most significant business and mission-critical risks that leaders currently cannot see on their dashboards.

The Imperative for a Global Standard (Why): Drilling down on the industry-wide need for a common language to discuss and measure AI risk. We will explore how a framework like the OWASP AI Vulnerability Scoring System (AIVSS) can create a foundation building block for Agentic AI Risk Management.

A Roadmap for Governance (How): Finishing with actionable takeaways on preparing for this new era. Addressing the organizational and talent gaps required to manage AI risk, the role of open standards in demonstrating due diligence, and the value proposition for investing in the people, processes, and tools for a mature AI security program.

This session is not a technical deep-dive. It is a high-level, strategic dialogue designed to provide CISOs, policymakers, and business leaders with the insights needed on their journey to learn about and govern the future of AI responsibly.

Dumb Ways to Die: Cybersecurity Edition

Despite years of enthusiasm since the Jericho Forum and Google's BeyondCorp, many still struggle to implement Zero Trust. The principles are known, but operationalizing ZTA stalls. Have CISOs been gaslit? The disconnect between promise and reality is painful. This session will deliver a practical framework for turning buzzwords into building blocks for successful programs.

Zero Trust has become the poster child for cybersecurity transformation and for buzzword fatigue. Introduced by the Jericho Forum in 2004, popularized by Google’s BeyondCorp in 2014, and formalized by NIST and CISA over the past five years, the concept promised a safer, more resilient enterprise. Yet for many security leaders, adoption has stalled. Why?

This session explores how visionary ideas get lost in translation between pundits, vendors, and practitioners. We’ll unpack four patterns that derail progress:

Misalignment. Pundits pontificate where engineers fear to tread. Thought leaders theorize, vendors overpromise, and engineers are left with impractical tools. We’ll provide tips for using buzzwords to garner excitement for projects without over-selling.

All-or-Nothing Fallacy. Many treat transformation as a single milestone. The all-or-nothing fallacy. Since the days of “Cloud first”, leaders have attempted transformations by placing large bets and believing the value would come when everything was done. Yet technical debt, cultural drag, failures of the technology, pitfalls in the buzzwords get in the way. We’ll show how to extract core concepts and creative ideas from fluffy concepts.

Shifting Definitions. As buzzwords mature, the goalposts move. Adoption surveys show declining success because definitions evolve faster than deployments. The trick is managing stakeholders’ and peers’ expectations while sustaining momentum.

Amara’s Law. “We tend to overestimate the effect of a technology in the short run and underestimate the effect in the long run.” Creating a cycle that capitalizes on project successes while taking advantage of new openings that happen post-implementation.

The resulting framework bridges the gap between theoretical principles and operational reality. It begins with identifying core business use cases and mapping out existing trust assumptions, followed by evaluating technologies not on their marketing claims but on their actual ability to support those use cases.

This is not a one-size-fits-all model, but a tactical guide to making Zero Trust (and really, any buzzword) into real, sustainable, and outcome-focused tactics. As it says in the abstract, turning buzzwords into building blocks for successful programs.

Ever felt SaaS logs are useless? This talk will expose 10 outrageous logging fails used by attackers to hide in plain sight: missing data, nonsense events, vanishing trails, and more. From M365 & Salesforce to Copilot & Gemini, each example will show the investigation roadblocks it creates, followed by enrichments, correlations and tricks to turn broken logs into detections and catch attackers.

This is an ADVANCED TECHNICAL TALK, focusing on real-world SaaS logging failures that SOC analysts encounter daily while trying to catch real threat actors - not theory. We’ll dissect 10 outrageous examples from M365, Salesforce, GitHub, Workday, Copilot, Gemini, and more, showing how each failure cripples detection or investigation. For every fail we’ll provide actionable workarounds: enrichments, correlations, and investigation tricks, that defenders can apply immediately. The goal: give security teams practical techniques to fight back even where SaaS vendors fail.

We’ll start with the broader challenges of SaaS logs from an IR/SOC perspective: inconsistent formats, lack of standardization, delays of 24–48 hours, and vendors’ poor understanding of what useful security logs require. AI SaaS (Copilot/Gemini/etc.) adds new challenges, often exposing even less security-relevant logging than traditional SaaS. We’ll outline the main categories of bad logging and tie each to the specific detection, investigation, and response tasks they break.

The core of the session will walk through 10 examples of terrible SaaS logging. Each will be demonstrated with real-world example, gaps between expectations and reality, and the security implications. For every case we’ll explain what’s wrong, why it matters, and how to fix it using other logs, configuration data or enrichment techniques. Examples include login sequences split across multiple sources (M365), missing user identifiers (Salesforce and others), unlogged authentication type (critical in SaaS phishing campaigns), out-of-order events, cryptic event descriptions, and events that never appear at all. We will also demonstrate new challenges introduced by AI SaaS (Copilot, Gemini, etc.).

Mitigation & Conclusion: We’ll close with strategies and tactics for defenders: preparing for SaaS logging gaps, enriching and correlating data during incidents, and building resilience against missing or misleading records. We’ll provide guidance on evaluating logs across SaaS platforms, handling retention and collection issues, and identifying weaknesses early. Finally, we’ll call on SaaS vendors to step up their logging - because defenders shouldn’t have to fight blind.

Attendees will leave with concrete techniques to turn weak logs into real detection power - tools they can apply right away. This is a must-attend session for SOC analysts and incident responders determined to catch attackers despite SaaS blind spots.

This submission delivers exactly what advanced technical tracks are designed for — real artifacts, named platforms, and specific failure modes that SOC analysts will recognize from their own queues, paired with immediate workarounds rather than vendor-dependent fixes. The structure of "here's what's broken, here's why it matters, here's how to work around it today" across ten concrete examples makes it one of the more actionable technical submissions a defender-focused audience could walk into.

An AI system is already ranked number one on the HackerOne bug bounty leaderboard. In DARPA's AIxCC challenge, 54 vulnerabilities were uncovered in hours of compute time, and Google's Gemini-based Big Sleep has identified dozens more. Adversaries like APT28 are reportedly folding LLMs into malware, closing the final gap of exploitation, and a flood of vulnerabilities is on the way, driven by exponential growth in discovery and a rapidly shrinking time to exploit.

The purpose of this talk is to present evidence of how this shift is already underway, and to help the community prepare.

Attendees will learn:

- How to build scalable triage and remediation flows to handle vulnerability volume.

- How to implement near-term defensive strategies to shrink attack surfaces and increase resilience.

- How to extend resilience beyond the enterprise by shaping the broader ecosystem, influencing vendors, supporting open-source security, and building coalitions with peers.

- How to prepare for a collapsing time-to-exploit and the risks of automatic exploitation during live operations.

We face a convergence of accelerated vulnerability discovery and shortened exploitation timelines. While security professionals are trained to avoid FUD, the facts themselves demand urgent attention. The traditional model of vulnerability management, designed for human-paced discovery, requires immediate evolution to handle AI-scale threats.

Throughout the session, we'll distinguish between genuinely transformative AI capabilities and incremental improvements to existing tools like fuzzing and static analysis, helping attendees separate signal from noise in the AI security landscape. Attendees will leave with actionable frameworks for evolving their vulnerability management programs to handle AI-scale threats while avoiding both complacency and panic.