CISO Leadership Summit – Ritz-Carlton Half Moon Bay

Registration Opens / Breakfast

Opening Remarks & Keynote

We've Seen This Movie Before: Applying the Cloud Hype Cycle to Security AI & Proving Hard ROI

Security executives face an unprecedented "AI Squeeze": boards demand an immediate AI strategy, threat actors leverage automation at machine speed, and teams are weary of black-box hype. Compounding this pressure, the era of subsidized AI experimentation is ending, forcing CISOs to prove hard ROI on AI investments.

This interactive discussion draws on hard-won lessons from the cloud migration wave—unrealized savings, lift-and-shift architecture, misconfigurations, and vendor lock-in—to evaluate current AI strategies in the SOC. CISOs will discuss how to avoid processing noisy pipeline data faster, protect against emerging threat surfaces like "AI gaslighting," and maintain model-agnostic control before unsubsidized token costs escalate.

Featuring real-world operational insights from Elastic as "Customer Zero"—where agentic triage reduced analyst effort from 30 minutes to under 3 minutes—participants will pressure-test their own AI roadmaps using a five-point diagnostic framework designed to establish defensible ROI, auditable reasoning, and long-term architectural flexibility.

Keynote

Safe and Trusted AI: Becoming a Resilient Organization in the Age of AI

AI security and data security aren't two problems. They're a package deal. Most organizations are still funded, staffed and governed as though they aren't. Assurance is where it shows first. In July 2026 Oracle shipped 1,449 patches in a single quarterly update, nearly triple its record, most of them found by AI. As a result of patch overload, it then moved to monthly updates, because quarterly couldn't keep up. The certifications your customers rely on were built for a slower cycle. Ronan Murphy will discuss running an AI security program when the frameworks and guardrails it was built on keep changing. How did you red team your own code? What has AI touched, and can you prove it stayed protected? Your customers and constituents are already asking. A trust program is how you answer with evidence, not assurances.

What you'll gain

✓ Why AI security and data security can no longer be funded, staffed or governed as separate programs.
✓ What to stand up now: AI scorecards, assurance programs and agentic review.
✓ How to answer "how did you red team your own code?" before a customer asks it.
✓ Achievable steps a security or compliance leader can start on right away

Panel Discussion

When Trust Infrastructure Won't Sit Still: Scale at Machine Speed 

Trust infrastructure is no longer static. AI, shrinking certificate lifecycles, machine identities, and post-quantum cryptography demand a shift from one-time deployment to continuous operations. This session explores how security leaders can build visibility, governance, and crypto-agility to manage trust as critical infrastructure and adapt to constant technological change.

Mingle Break

Keynote

Edge Transformation: Top 5 SASE Predictions and Trends

Secure Access Service Edge is entering mainstream adoption. Enterprises are shifting from point solutions to platforms. And AI is now at the core of SASE. These are among the five predictions/trends noted by Fortinet as it looks into the SASE future. And they are the foundation of this exclusive roundtable discussion about the present and future of SASE – and why it is urgent to reevaluate cybersecurity at the edge.

Join your peers, as well as AI security leaders from event sponsor Fortinet, for an exclusive roundtable where we cut through the noise and get practical about the present and future of SASE.

Among the discussion topics:

Why unified SASE is the new default
How universal ZTNA will fully replace VPN
Implications of the high growth of data sovereignty demands

Keynote

Rethinking Security for Agentic AI — From Control to Orchestration

As AI shifts from assistive systems to autonomous agents acting across business
environments, data becomes the true control surface. These agents require broad
access to data, identities, and business processes, creating new risk patterns as
sensitive data and outbound actions converge at machine speed. This is a control shift.
CISOs must modernize how data is governed, authorized, and protected so
organizations can adopt agentic AI confidently without losing oversight.

Join this session to explore how to:
● Detect emerging risk behaviors in autonomous AI
● Build a data-centric and intent-aware security model
● Establish the CISO as the orchestrator of scalable AI and business growth
enabler

Panel Discussion

Practical implementations of crypto agility to eliminate outages

As certificate lifecycles shrink and emerging technologies like AI and post-quantum cryptography reshape the security landscape, crypto-agility is becoming a critical enterprise priority. This panel will explore how CIOs and CISOs can improve visibility into cryptographic assets, embrace automation to reduce outages and operational risk, and build a more agile foundation for the changes ahead.

Lunch

Keynote

Artisanal Attacks Are Over: Defending When Novel Costs Nothing

A targeted, well-written, never-before-seen attack used to require a skilled human and real time. A local model on a laptop now produces one for the price of electricity. The economics that made novel attacks rare have collapsed, and the security programs built on that scarcity are the ones about to find out.

Sublime Security's Jack Hirsch argues that when novelty becomes free, the control that decides outcomes shifts from detection accuracy to time-to-coverage: how long your environment stays exposed between a new campaign's first attack and real protection against it.