41st CISO Insight Summit

The opening keynote confronts the defining tension of the year: AI adoption is now a survival requirement, and it is simultaneously the fastest-growing source of enterprise risk. Drawing on a live enterprise program rather than theory, this session examines how one security leader has enabled the business to move at speed without writing the incident report of 2027, covering the decisions that earned trust with the CIO and the board, the controls that proved worth the friction, and the moments where saying no was the right call.

You'll leave with a clear-eyed view of what a defensible AI security posture looks like in practice, the questions to ask before your next model or agent goes live, and a sense of where your own programme sits against a peer who is further down the road.

As a continuation of the Catalyst Mission track, these sessions will establish a strategic blueprint to chart the pathway toward identifying a solution.

Track 1: Securing AI at Scale: Enabling Innovation Without Introducing Unmanageable Risk
Track 2: Cyber Resilience as a Business Imperative: How to Position The CISO's Agenda to The Board
Track 3: Identity Security: Defending the New Enterprise Perimeter
Track 4: Your Perimeter Is a Myth: Managing Third-Party Risk in an Interconnected Digital Ecosystem

Most conversations about AI and security focus on defending against it. This one flips the lens: how do you use it? Hosted by a practising CISO, this closed-door discussion gets specific about where AI is genuinely earning its place in the security function, from accelerating policy development and review, to triaging and prioritising vulnerabilities against an unmanageable backlog, to compressing the timeline from detection to containment during live incident response.

Expect an honest exchange about what has worked, what over-promised, and what it takes to trust an AI-assisted output when the stakes are high. You'll leave with peer-tested use cases you can pilot immediately, a realistic view of the effort behind each, and a candid account of the failure modes worth avoiding.

The window between a patch being published and exploitation in the wild has collapsed from three weeks to under seven days, and with AI now able to reverse-engineer patches, generate exploit code and scan the internet for unpatched targets at machine speed, it is heading toward hours, then minutes. At the same time, patch volumes have quadrupled, leaving even well-resourced teams unable to keep up using yesterday's playbook.

Drawing on his vantage point leading cybersecurity at the world's largest security equipment manufacturer, Chuck Davis cuts through the AI hype to the two shifts every enterprise needs to make now: ruthlessly reducing the internet-facing attack surface, because every camera, sensor and IoT device is a computer on your network and if it doesn't need to be online it shouldn't be, and moving from severity-based to risk-based patch prioritisation, so effort flows to the vulnerabilities that genuinely threaten your organisation rather than the loudest CVSS scores. Attendees will leave with a clear-eyed view of how quickly the ground is shifting and a practical framework for reassessing exposure and patching strategy before the zero-day clock runs down to zero.

Most conversations about AI and security focus on defending against it. This one flips the lens: how do you use it? Hosted by a practising CISO, this closed-door discussion gets specific about where AI is genuinely earning its place in the security function, from accelerating policy development and review, to triaging and prioritising vulnerabilities against an unmanageable backlog, to compressing the timeline from detection to containment during live incident response.

Expect an honest exchange about what has worked, what over-promised, and what it takes to trust an AI-assisted output when the stakes are high. You'll leave with peer-tested use cases you can pilot immediately, a realistic view of the effort behind each, and a candid account of the failure modes worth avoiding.

Most conversations about AI and security focus on defending against it. This one flips the lens: how do you use it? Hosted by a practising CISO, this closed-door discussion gets specific about where AI is genuinely earning its place in the security function, from accelerating policy development and review, to triaging and prioritising vulnerabilities against an unmanageable backlog, to compressing the timeline from detection to containment during live incident response.

Expect an honest exchange about what has worked, what over-promised, and what it takes to trust an AI-assisted output when the stakes are high. You'll leave with peer-tested use cases you can pilot immediately, a realistic view of the effort behind each, and a candid account of the failure modes worth avoiding.

Cyber insurance has quietly become one of the toughest audits a CISO faces. Underwriters now probe MFA coverage, EDR deployment, privileged access, backup isolation and incident response readiness in forensic detail, renewal questionnaires have become attestations with real legal weight, and a control you claimed but couldn't evidence can mean a denied claim at the worst possible moment.

Led by former insurer, this roundtable offers a genuine peek behind the curtain: how carriers actually read your application, which controls move the premium and which merely tick boxes, where policyholders most often misrepresent their estate without realising it, and what claims teams look for when deciding whether you're covered. Working under Chatham House rule, participants will benchmark how peers are aligning their security roadmaps with underwriting expectations, and leave knowing how to prepare for their next renewal or audit with evidence rather than assertions, how to manage the estate so coverage terms improve rather than erode, and how to make sure the policy they're paying for is one that will actually respond.

Global scale and local control pull in opposite directions, and data sovereignty rules keep tightening the vice. This session examines how organizations are running genuinely global cloud platforms while satisfying an expanding patchwork of residency, privacy and regulatory requirements, without fragmenting into a dozen incompatible regional estates.

It covers architectural patterns that keep sovereignty manageable, the governance model that makes multi-jurisdiction operation sustainable, and where centralization is worth defending against local pressure. You'll take away a practical view of the sovereignty decisions coming down the track and how to design for them now rather than retrofitting later.

Buying a gym membership doesn't make you healthy, and buying a tool, writing a process or hiring a team doesn't make your security effective. Only daily practice, measured continuously, does. Surinder Singh Rait leads Global IT Security Assurance at Ericsson, whose networks carry more than half the world's telecom traffic, and his remit is deceptively simple to state and brutally hard to execute: prove to management, boards, regulators, insurers and customers that security actually works.

In this keynote, Surinder shares the four-year journey from standing up a unit that didn't exist to a fully automated assurance capability spanning attack surface management, supply chain security, frameworks from NIST to NIS-2, and real-time control oversight through a single data lake, validating every control, every day, across 180 countries. You will leave with a practical blueprint for building assurance into your own program at whatever scale you operate: how to move from point-in-time audits to continuous evidence, what insurers and regulators actually ask for on the day things go wrong, and how to answer the hardest question a security leader faces, because breaches are not a matter of if but when: "how do we know it's working?

AI is rewriting both sides of the cyber risk equation: attackers are using it to industrialise phishing, impersonation and reconnaissance, while boards push to adopt it faster than most risk programs can govern. Chris Bullock, CISO of Aveanna Healthcare, one of the largest home care providers in the US, brings a rare perspective to that challenge, having spent a decade in law enforcement, built security programs from a blank page across retail, energy, gaming, government and healthcare, and still serving as a certified reserve investigator with the Georgia Bureau of Investigation.

Drawing candidly on Aveanna's own security journey and his investigative casework on the front lines of cybercrime, Chris will share a practitioner's blueprint for cyber risk management that holds up in the AI era: quantifying and communicating risk in language the board will fund, governing AI adoption without becoming the department of no, defending a distributed, human-heavy workforce against AI-accelerated social engineering, and knowing which fundamentals still prevent most incidents versus where AI genuinely changes the calculus.

Legacy platforms are where security debt compounds quietly, in unpatchable systems, scarce skills, and controls bolted on decades after the architecture was set. This session tells the story of a multi-year legacy exit that actually finished and actually paid back: how the business case was built and defended across budget cycles, how risk was managed during the long middle period when both old and new ran in parallel, and what the security posture looked like on the other side.

You'll take away a migration approach that survives leadership changes, the arguments that unlock funding for work with no visible feature output, and the risk-reduction case for finally tackling the system everyone has learned to live with.

Continuing your mission tracks, having built the blueprint we now enter the reckoning – a decisive phase where insights are rigorously challenged and crystallised into solution-led outcomes.

Track 1: Securing AI at Scale: Enabling Innovation Without Introducing Unmanageable Risk
Track 2: Cyber Resilience as a Business Imperative: How to Position The CISO's Agenda to The Board
Track 3: Identity Security: Defending the New Enterprise Perimeter
Track 4: Your Perimeter Is a Myth: Managing Third-Party Risk in an Interconnected Digital Ecosystem

Most enterprises have finished migrating and are now living with the result: sprawling estates, unclear ownership, costs that grow faster than usage and a security posture stretched across environments nobody fully maps.

This session is about the phase after migration, namely consolidating, governing and turning a scattered cloud footprint into genuine operating leverage. It covers the visibility and ownership models that make sprawl manageable, where consolidation delivers both cost and risk benefits, and how to make the case for cleanup work that doesn't ship features. You'll leave with a diagnostic for your own estate and a prioritised set of moves that reduce exposure and spend at the same time.

Most security organizations are structured to absorb attacks. Golan Ben-Oni has spent two decades proving there is another way. As CIO and CISO of IDT Corporation; a role spanning seven verticals from telecoms to fintech, Golan runs one of the most distinctive strategic offensive security programs in the private sector: actively pursuing the state-sponsored threat actors targeting his business, in coordination with partners including Palo Alto Networks, SentinelOne, Mandiant and Microsoft.

From the operation against Russian state actors that made the front page of The New York Times in 2017 to the takedown campaigns he is leading today, this closed-door case study examines what it really takes for a defender to play both sides of the court: when offense is a legitimate and necessary component of defense, how to build the ecosystem and legal partnerships that make it possible, and why collaboration — even with direct competitors — is now a survival requirement. Woven throughout is the tension every leader in the room is living with: driving the AI adoption a legacy enterprise needs to stay alive over the next five years, while denying that same technology to the adversaries working around the clock to get in.

Every organization carries systems too critical to fail and too old to defend properly, and the traditional answer of a multi-year big-bang replacement has a failure rate that makes boards understandably nervous.

This session explores the composable alternative: decomposing critical platforms incrementally, delivering value and reducing risk at each step rather than at the end. It covers where to cut first, how to keep security and integrity intact while the architecture is in motion, and how to sustain momentum on a program measured in years.

You'll take away a staged approach to modernizing the systems you can least afford to break, and the governance that keeps an incremental program from stalling halfway.