SecureWorld Threat Defense Virtual Conference 2026

Your opportunity to visit our solution vendor partners, whose sponsorship makes SecureWorld possible! Peruse the many downloadable resources each booth has to offer.

Visit the Networking Hall to network with attendees and connect with our supporting solution providers and association partners.

Enterprise identity can no longer be reduced to a login gate. Modern products span admin consoles, workspaces, APIs, and privileged workflows, often across multiple identity providers and assurance levels. This session presents a vendor-neutral architecture that separates principal eligibility, resource authentication requirements, and session assurance. It examines common failures in coarse-grained SSO and shows how teams can introduce stronger controls using policy evaluation, shadow decisions, decision logging, staged enforcement, and rollback safeguards without causing widespread access failures or creating brittle user experiences.

Attendees will leave with a practical architecture and rollout checklist for building resource-aware authentication and authorization controls across complex enterprise products.

Modern security architectures are built on assumptions—about identity, trust, attacker behaviour, analyst workflows, and the boundaries between systems. Those assumptions weren’t mistakes; they were the foundation upon which effective security programs were designed.

As AI reshapes both offensive and defensive capabilities, many of the conditions surrounding those assumptions are beginning to change. The question for security leaders isn’t whether to abandon existing approaches, but how to recognize which assumptions continue to serve us, which deserve to be revisited, and what that means for the future of threat defense.

Rather than focusing on the latest AI tools or attack techniques, this session explores a broader question: how should we think about threat defense when the environment itself is changing? Through the lens of systems thinking, resilience, and organizational adaptation, we’ll examine how AI is influencing the assumptions that underpin modern cybersecurity—and why revisiting those assumptions may become an increasingly important part of building resilient organizations.

As AI agents gain access to enterprise applications, APIs, sensitive data, and automated workflows, security teams must defend a new class of autonomous identities. This session presents a practical framework for securing the agentic enterprise by establishing clear human-to-agent-to-tool trust boundaries. It explores least-privilege access, scoped credentials, authorization controls, human approval for high-risk actions, and behavioral monitoring for abnormal agent activity. The session examines how existing Zero Trust, IAM, API security, and cloud security practices can evolve to address agentic threats while enabling responsible AI adoption without creating another isolated security program or adding unnecessary operational complexity.

Attendees will leave with a practical framework to secure AI agents through identity controls, Zero Trust principles, least-privilege access, human oversight, and behavioral monitoring.

Visit the Networking Hall to network with attendees and connect with our supporting solution providers and association partners.

Organizations are rapidly adopting AI copilots, autonomous agents, and intelligent workflows, yet most governance models still focus on individual AI systems rather than the enterprise intelligence ecosystem. This session introduces the concept of the AI Intelligence Engine—a centralized governance layer that enables organizations to securely manage AI decision-making, enforce policies, maintain regulatory compliance, and strengthen cybersecurity across all AI-enabled business processes. Attendees will learn a practical framework for governing AI at scale while balancing innovation, operational resilience, and evolving global regulations.

Just like a cyberattack, a deepfake hiring scam follows a predictable sequence of stages—from reconnaissance and identity fabrication to interview deception and, ultimately, insider access. In this session, we’ll walk through the Deepfake Kill Chain step by step: how bad actors research targets, construct synthetic identities, pass video interviews using real-time face-swapping and voice cloning, and slip past traditional background checks. We’ll examine real-world case studies, break down where each stage can be detected and disrupted, and show how organizations can build defenses at every link in the chain—before a synthetic candidate ever becomes an employee.

Session details to come.

Visit the Networking Hall to network with attendees and connect with our supporting solution providers and association partners.

As organizations race to deploy AI-powered applications, the attack surface is expanding in ways that traditional security frameworks were not designed to handle. This session draws on production engineering experience at Amazon to examine the cybersecurity implications of large-scale AI systems: adversarial inputs, model supply chain risks, inference infrastructure vulnerabilities, and the governance gaps that emerge when AI moves faster than policy. Attendees will leave with a practitioner’s framework for evaluating AI-related risk in their own environments.

As enterprises push agentic AI into systems that act independently, pricing, discounting, engaging customers, and increasingly making operational decisions across the network itself, the core question shifts from “does the agent work” to “can the enterprise still trust and control it.” This session presents an architectural framework for controlled autonomy: giving agents real decision-making power while keeping enterprise governance, compliance, and security intact.

At the center is a trust layer that scores every AI-generated decision on confidence, policy alignment, and risk, enabling dynamic calibration of human involvement. Low-risk decisions get automated; high-impact ones get escalated, so autonomy scales operationally without giving up governance. Sitting alongside it is compliance-aware orchestration, validating every agent action against dynamic policy graphs in real time, so agents stay within regulatory, contractual, and internal constraints even as multiple agents interact and coordinate.

A major focus is on human override: intelligent escalation triggers and contextual decision summaries that reduce cognitive load and speed up turnaround for security and operations teams managing high-velocity, autonomous environments. We’ll also cover observability, explainability, and auditability, building a transparent decision fabric so every autonomous action stays traceable, a requirement for any security-conscious enterprise deploying agentic systems at scale.

The session closes with enterprise integration patterns, bounded autonomy gateways, and parallel decision simulation, that let organizations deploy agentic AI broadly while keeping governance and security consistent as autonomy expands across the network.

Session details to come.

Visit the Networking Hall to network with attendees and connect with our supporting solution providers and association partners.

Security operations teams don’t have a headcount problem, they have a signal-to-noise problem. Over the past year, Rover’s ticket volume grew 640%—and our mean time to resolution still went down, at one point dropping four hours in a single month. This talk explains how, and then shows what that time savings actually bought us during a real attack.

First, the mechanics: we built an automated triage pipeline that connects our EDR, SIEM, and phishing tools to an LLM (Gemini). Every alert triggers a purpose-built Lambda that gathers the right context—process trees, sender domain age, login history, the underlying SIEM query—and hands it to the model with a tightly scoped prompt (including explicit instructions to treat email content as untrusted data, not commands). Within seconds, a structured verdict, reasoning, and recommended action lands as a comment on the ticket. Work that took an analyst 20-30 minutes now takes seconds, and every AI verdict is clearly labeled and still requires human sign-off before action.

Then, the case study: this summer Rover faced repeated waves of automated toll fraud—thousands of fake accounts created via disposable email domains to abuse SMS verification across international phone numbers. I’ll walk through how a cross-functional team (fraud ops, engineering, and cybersecurity) used the analyst time freed up by AI triage to focus on the harder problem: real-time network and application-layer countermeasures—domain blocking, feature-flag kill switches, and edge/WAF rules—to contain each wave within hours instead of days. You will leave this presentation with concrete actions you can take back to your organization and ways to implement without a giant budget ask.

Session details to come.

Session details to come.

Visit the Networking Hall to network with attendees and connect with our supporting solution providers and association partners.