Coming soon!

Coming soon!

At 5PM ET on a Friday, your security lead tells you a backdoored NPM package may have been merged into production. Do you notify customers? The SEC? Your insurance provider? Is this an insider?

This session walks through a real-world supply chain breach that included post-exploitation payloads using AI, showing why proof matters more now than ever. Attendees will learn how to:

• Trace a supply chain compromise from NPM, to a developer's laptop, through CI/CD into production and the AI agents running there
• Add a prove function to the NIST framework by mapping every action to the originating identity, whether AI, human, non-human, or third party
• Determine whether an event is an incident, how quickly you can know, and who you need to contact and when

We’re now taking a break!

Take this opportunity to visit the Exhibit Hall and explore our sponsors’ resources, solutions, and latest insights. Their subject matter experts are available now and ready to answer your questions and connect with you. Be sure to stop by before the next session begins!

AI has produced no shortage of demos, claims, and new terminology. But after the initial wave of experimentation, TPRM teams need a more useful conversation: What is actually working? Where is AI improving the process? And where is it simply adding another layer of complexity and cost, when workflow automation could get the job done just as well? 

This session shares practical lessons from applying a Hybrid AI approach across the third-party risk lifecycle. Hybrid AI introduces a realistic way of adopting AI that includes giving AI a clearly defined job, grounding it in reliable evidence, keeping it inside a governed workflow, and being deliberate about where human review belongs. We’ll look at the use cases delivering real value at companies today, the ones that remain more gimmick than solution, and the pros and cons of using AI vs. traditional workflow automation.  

We’ll also make the case that subject-matter expertise matters more, not less, as AI becomes more capable. AI can gather evidence, summarize documentation, and help teams work through larger portfolios. It cannot decide what good risk management looks like on its own. The strongest results come from combining AI with risk expertise, established processes, and a clear record of how conclusions were reached. 

Attendees will leave with a practical view of what AI can do well in TPRM today, what still requires caution, and how to build on those lessons as the technology evolves. 

Coming soon!

We model threats against our networks with rigor, then ignore the most predictable failure mode in the building: the exhausted human holding the pager. Burnout is not a wellness footnote. It is dwell time, alert fatigue, missed signals, and attrition that walks institutional knowledge out the door. In this session I draw on nearly thirty years in security operations and on validated instruments like the Maslach Burnout Inventory to show how to treat burnout as measurable operational risk. You will see how to baseline fatigue across a SOC, spot the leading indicators before resignation letters arrive, and build prevention into staffing, on-call, and incident response rather than bolting it on after a crisis. The goal is a security program that stays sharp under sustained pressure, because resilient systems depend on resilient people.

Learning objectives for attendees:

1. Frame burnout as quantifiable operational risk tied directly to detection, response, and retention outcomes.
2. Baseline and track fatigue across a security team without invasive surveillance.
3. Identify the leading indicators of burnout early enough to intervene.
4. Build prevention into on-call rotations, staffing, and incident response playbooks, with board-ready language to fund it.

Chinese developed open weights LLMs have repeatedly triggered panic among Western AI developers, politicians, and investors.

• What is the actual capability of Chinese AI?
• Why are Western states and politicians so concerned?
• How is China putting their home grown LLMs to use to achieve their goals and extend their influence?

This session will explore these topics, looking at raw LLM capability, geopolitical motivations, and actual applications of Chinese LLMs in cyber incidents. Most importantly, this session will make predictions as to the likely direction of movement, and what this could mean for organizations and individuals, whether they are in the Chinese cyber firing line or not.

Most talks on the EU Cyber Resilience Act (CRA) are about manufacturers. This one is for the buyer.

Since 11 September 2026, manufacturers selling products with digital elements on the EU market must send an early warning within 24 hours of becoming aware of an actively exploited vulnerability in their product. This also applies to products placed on the market before that date, and manufacturers must inform affected users. Products placed on the market from 11 December 2027 must also meet security requirements. Their manufacturers must tell buyers at the point of sale how long they will receive security updates, and provide those updates free of charge during that period, unless a business buyer agrees otherwise for a tailor-made product.

Some things you used to negotiate are now law. Others are not, and that is where buyers often get it wrong. Many assume suppliers must hand over a full SBOM. They do not: manufacturers must keep one, but sharing it with users is optional. Many also assume the new legislation creates a right for businesses to recover their own losses from suppliers. It does not. Liability between buyer and supplier remains primarily a matter of contract and national law.

I work with manufacturers on their CRA obligations, and this session ends with a one-page checklist: what the law now gives you, when each obligation applies, and what you still need to put in the contract.

Coming soon!