AGENDA

Josh Yost, Palo Alto Networks | Beyond the Playbook: Reclaiming the SOC through Agentic Intelligence

Main Hall

Standard automation has hit a plateau. While traditional SOAR reduced some manual toil, it often traded one type of "busy work" for another: playbook maintenance. To get back to the basics of effective defense, we need automation that understands intent, not just instructions. This presentation dives into the architecture of Agentic Automation within the Cortex ecosystem. We’ll demonstrate how Agentix functions as a digital force multiplier, handling the investigative heavy lifting so analysts can focus on high-context decision-making. Learn how to simplify your operations by automating the sophisticated, not just the mundane.

Hall of Ideas E

After 15 years on the customer side of security, I’ve learned that effectiveness often looks very different in practice than it does on paper. This talk focuses on the fundamental practices that consistently work in real environments, and why returning to basics still matters.

Nate Kroll | Director of InfoSec and Compliance, Quad

Chris Eckel | Senior Cybersecurity Engineer, Quad

Shaun Halverson | Cybersecurity Engineer, Quad

Hall of Ideas F

As security teams face growing volumes of alerts, logs, and correlated events, the real challenge isn’t collecting more data, it’s making sense of it faster. Quad’s security operations team shares how they applied AI in a practical and iterative approach to strengthen incident response without surrendering human judgment. Attendees will walk away with practical insights into how AI can enhance, not override, human-led security operations.

Kevin Jacque | Strategic Channel Solution Engineer, CyberArk

Hall of Ideas G

The shift to 47 day TLS certificate validity is redefining operational expectations for every organization, changing certificate management from a nice to have to a must have. This presentation highlights why manual processes can no longer keep pace, how shortened lifecycles increase outage and compliance risks, and what leading teams are doing to prepare. It introduces a practical maturity model and automation playbook designed to restore visibility, accountability, and resilience. Ultimately, the session equips organizations to transition from reactive firefighting to proactive, scalable certificate automation.

Hall of Ideas J

As automation begins influencing firewall rule cleanup and optimization, many environments remain dependent on undocumented intent and tribal knowledge. This breakout explores how structured policy design and disciplined rule modeling determine whether automation strengthens security — or scales architectural blind spots.

Stephen Frethem | Field CTO, Varonis

Hall of Ideas I

Stephen Frethem, Varonis’ Field CTO, will discuss the evolving cybersecurity landscape and the growing risks AI poses to data security. This presentation advocates for leveraging AI to protect sensitive data and manage access more effectively, underscoring the urgent need for organizations to adapt as these new threats emerge.

Alessandro Barbieri | Product Line Director, Arista

Hall of Ideas H

Arista Networks™ Macro-Segmentation Service - Firewall (MSS-FW) capability for CloudVision® allows dynamic segmentation to be deployed automatically for specific workloads and workflows across modern overlay network virtualization fabrics. MSS-FW addresses a growing gap in security deployment for hybrid data centers. It extends the concept of fine-grained intra-hypervisor security for virtual machines (VMs) to the rest of the data center by enabling dynamic insertion of services for physical devices and non-virtualized devices.

By integrating with native APIs and Palo Alto Networks Panorama™ network security management, MSS-FW learns the security policies, identifies the workloads the firewall needs to inspect, and takes action. Upon identification, MSS-FW steers relevant traffic to the firewall, dynamically inserting the firewall in the path of workload flows. The automation capabilities of Arista MSS-FW allow it to operate autonomously in real time.  No special architecture is required to support MSS - Arista’s standard AVD designs will work. This flexibility ensures the successful deployment of security in an enterprise’s private or hybrid cloud.

Josh Havlik & Michelle Sprague | Senior Information Security Engineer & Information Security Engineer, CapSpecialty

Hall of Ideas E

Too often security gets launched at people like a trebuchet of rules; we chose a different path. Security only works when people feel safe engaging with it. This talk shows how approachability and empathy turn everyday interactions into trust. We will explain how we are using fun, rewards, and a cool head to reduce anxiety and build lasting habits. We will share how these principles became the core of our program and why that shift changed outcomes across the company.

Hall of Ideas F

A follow up to DEEP608v9 "Not Your Daddy's DNS" highlighting how DNS is being used in new ways. DNS now plays a critical role in TLS 1.3 Encrypted Client Hello (ECH) with Type 64 SVCB and Type 65 HTTPS records. Wait, what is ECH? Let's find out. We'll also revisit DNS over HTTPS (DoH) and a few other topics.

Dan Placek | Principal Solutions Architect, AE Business Solutions

Hall of Ideas G

AI-assisted software development, so-called vibe-coding, is taking off. How do you enable your dev (or IT) teams to embrace this capability without compromising on security?

Andrew Goodman | Director of Product Marketing, Proofpoint

Hall of Ideas J

AI is now executing 80-90% of email threats. These campaigns are no longer “spray-and-pray.” They’re precision operations with automated reconnaissance and tailored narratives delivered faster, cheaper, and at massive scale. This session cuts through the “AI vs. AI” noise to give security buyers a practical roadmap for protecting M365. Attendees will leave with a clear threat model for AI-driven email campaigns targeting M365 and a concise understanding of the must-have defenses needed to stop the next wave of AI-powered email attacks.

Robert Chuvala | Security Solutions Architect, AE Business Solutions

Hall of Ideas I

In 2015 we were worried about phishing, ransomware, Active Directory abuse, exposed RDP, and alert fatigue. In 2026… we’re worried about phishing, ransomware, Active Directory abuse, exposed management planes, and alert fatigue.

Hear directly from security leaders in the field as they share real-world experiences, lessons learned, and what’s actually working in today’s cybersecurity landscape. No vendor pitch, just honest insights from those doing the work every day.

‍

Amy Diestler | Chief Information Security Officer, SMPH

ChaChi Gallo | Vice President Information Technology, Michels

Mike Reineck | Director of IT Security, Baird

Shuchi Wadhwa | Global Cybersecurity Strategy Lead, Schreiber Foods

Jestin Moe | Security Solutions Architect, AE Business Solutions

Hall of Ideas E

Over the last decade, we’ve been told that “zero trust” and “segmentation everywhere” will fix all our problem when in reality, many organizations still live on flat networks, half baked segmentation projects, and security policies nobody wants to touch. This session goes back to basics on segmentation where we can clearly define boundaries, reduce blast radius, and keep the design boring in the best way possible. We’ll walk through how to segment your environment with identity at the core, instead of relying on traditional static controls.

Gunther Krause | Senior IT Infrastructure Consultant, WEC Energy Group

Hall of Ideas F

WEC Energy group is deploying a new log collection/aggregation system to simplify log retention and shipping to various applications. At the start of their journey for this, they would like to go over and share what they have learned so far.

Mark Stanford | Sales Engineering Director, Cyera

Hall of Ideas G

Ten years ago, most organizations believed they knew where their sensitive data lived. Today, data sprawls across multi-cloud infrastructure, SaaS ecosystems, collaboration platforms, and AI environments, often without clear ownership or visibility.

As data scale and complexity outpaced legacy controls, incremental tools built for static environments and periodic scanning could not keep up. This gap gave rise to a new architectural model: the data security platform. We will explore why traditional classification, DLP, and siloed approaches struggled under modern conditions, and how integrated, continuous, and AI-native strategies are reshaping the industry and redefining how organizations manage data risk.

Phil Henrickson | Senior Data Scientist Service Delivery, AE Business Solutions

Hall of Ideas J

The rise of assisted coding tools has made coding more accessible than ever. Everyone can generate code now — but can everyone design systems and software? In an era of vibe coding, the ability to think like a software developer is more important than ever. Coding was never the hard part.

How do you improve your ability to design systems and architecture? By playing a video game, of course.

In this talk, I discuss how Factorio — a game about building factories on an alien planet — teaches critical lessons about systems design, iterative development, and managing complexity that directly apply to software engineering. Playing a video game won't make you a developer, but it will teach you to think like one.

Alex Humphrey | AI Security Engineer, 7AI

Hall of Ideas I

What happens when a phishing campaign passes every email security check, earns your gateway’s highest trust score, and delivers its payload through a channel your defenses were never designed to inspect? That’s exactly what 7AI’s Threat Research team uncovered in early 2026: a multi-wave quishing operation that embedded malicious URLs inside QR code images, slipped past SPF, DKIM, DMARC, and Microsoft Defender, and targeted over 30 recipients across three coordinated waves — all while evidence pointed to more than 1.6 million parallel targets at other organizations.

In this session, we’ll take you inside the real-world detection story — from the initial AI-driven alert that flagged what looked like a routine email, to the expert analyst who recognized one phishing attempt is never the whole picture, to the targeted threat hunt that mapped an entire 20-day campaign. You’ll see how attackers are combining well-known techniques in ways that exploit a fundamental blind spot in email security architecture, why this matters for any organization relying on traditional controls, and what you can do about it today. Whether you’re running a SOC, managing email security policy, or setting defensive strategy, you’ll leave with a clear understanding of where the gaps are and practical steps to close them.

Hall of Ideas H

Invitation Only.

Griffin Cass | Information Security Architect, UW Credit Union

Hall of Ideas E

Here's an uncomfortable question: if a zero-day dropped right now, could you query your inventory and know every affected asset within the hour? If you hesitated, this talk is for you. We're living in an era of non-human identity sprawl, agentic workflows with broad permissions, and copilots indexing data you haven't classified yet. The tools are moving faster than our foundations, and we can't keep stacking advanced capabilities on top of asset inventories held together by institutional knowledge and a spreadsheet from 2019. This session walks through why the CIS 18 Controls are numbered the way they are (hint: it's a dependency chain, not a buffet), dives into the controls where most orgs are quietly struggling, and lands on the part leadership actually wants to hear: how to measure maturity with simple math, crosswalk one framework to many, and start the whole thing for the low price of zero dollars.

Patrick Ruffino | Infrastructure Solutions Architect, AE Business Solutions

Hall of Ideas F

This session positions data protection for identity platforms as the primary focus of your recovery strategy, not an afterthought. Learn how to build resilient backup and recovery for your identity stores, minimize recovery time during breaches or outages, and integrate automated testing so you can prove — not just hope — that you can bring your identity platform back online under pressure.

Jonathan Lampe| Group Manager, Milwaukee Tool

Hall of Ideas G

Vibe-coding with AI assistants has changed the development landscape.  LLMs now propose architectures, generate implementations, and even help debug and extend applications. The result is dramatically increased development velocity — and a fundamentally different security landscape.

This talk walks through real observations from building and securing multiple LLM-generated applications. We’ll examine how traditional risks reappear in new forms: implicit trust boundaries, over-permissive defaults, and deferred security controls hidden behind TODO comments. We’ll then explore risks unique to AI-integrated systems, including prompt injection, plausibility-over-truth behavior, multi-LLM authority confusion, and security assumptions expressed only in natural language.

However, AI-driven development does not simply increase risk — it changes how security must be applied. We’ll demonstrate how traditional controls such as threat modeling, RBAC, SAST, and software composition analysis still matter, but must be paired with new practices: scoped LLM roles, prompt-aware testing, and using the model itself to identify and validate security weaknesses.

Attendees will leave with a practical framework for securing applications where the developer is no longer the sole author — and where the fastest path to secure software may involve collaborating with the same AI that created it.

Michael Leland | Field CTO, Island

Hall of Ideas I

As generative AI adoption hits unprecedented levels, organizations are frequently overwhelmed by the new chaos of shadow AI, data leakage, and evolving compliance risks. This session steps away from the hype to focus on the fundamental building blocks of AI safety, exploring how establishing core visibility, zero-trust governance, and fundamental data protection at the browser level is essential for secure adoption. Attendees will leave with a foundational readiness checklist and practical strategies to confidently empower their workforce with AI while protecting their most valuable corporate data.

Rob Rodriguez | Senior Director of Engineering, Firemon

Hall of Ideas J

What do radio jamming, signal interception, and direction finding have to do with modern cybersecurity? More than you think. Drawing from a decade in Marine Corps signals intelligence and electronic warfare, Rob connects battlefield concepts like signal dominance and spectrum control to today’s security challenges. The tools have changed. The fundamentals have not.

10 Lessons From 10 Years of Cyber Recovery

Josh Stenhouse | Cyber Resilience CTO, Rubrik

Main Hall

Join keynote speaker Joshua Stenhouse in his lessons learned over the past 10 years from being a part of over 350 major ransomware recoveries to blow away common misconceptions and help prepare you for the worst case sceneraio of having to recover your entire organization from backups