41st CISO Insight Summit

When the federal government's formal planning assumption becomes "the adversary may already be inside," every enterprise risk conversation changes. In this opening keynote, Deron McElroy, CISA's Chief of Cybersecurity for Region 6 and one of the architects of the nation's cybersecurity advisory and incident response frameworks, brings the room inside CI Fortify, CISA's newest initiative, which asks critical infrastructure operators to plan for the hardest scenario: operating safely for weeks or months while isolated from compromised networks, with no outside help coming.

Deron will share what CISA is actually seeing across the Gulf Coast region's threat landscape, where the agency's strategic priorities are heading, and what the shift from prevention to resilience means practically for the leaders in this room, from mapping third-party OT dependencies to proving you can run degraded. You will leave knowing which preparations matter first, how to put CISA's no-cost regional services, assessments and exercises to work for your own program, and what the agency needs from industry in return. Delivered under the Chatham House Rule, this is the federal perspective without the filter, and it sets the tone for the summit itself: the candour we practise in this room is exactly the public-private trust the moment demands.

As a continuation of the Catalyst Mission track, these sessions will establish a strategic blueprint to chart the pathway toward identifying a solution.

Track 1: Securing AI at Scale: Enabling Innovation Without Introducing Unmanageable Risk
Track 2: Identity Security: Defending the New Enterprise Perimeter
Track 3 Your Perimeter Is a Myth: Managing Third-Party Risk in an Interconnected Digital Ecosystem

The window between a patch being published and exploitation in the wild has collapsed from three weeks to under seven days, and with AI now able to reverse-engineer patches, generate exploit code and scan the internet for unpatched targets at machine speed, it is heading toward hours, then minutes. At the same time, patch volumes have quadrupled, leaving even well-resourced teams unable to keep up using yesterday's playbook.

Drawing on his vantage point leading cybersecurity at the world's largest security equipment manufacturer, Chuck Davis cuts through the AI hype to the two shifts every enterprise needs to make now: ruthlessly reducing the internet-facing attack surface, because every camera, sensor and IoT device is a computer on your network and if it doesn't need to be online it shouldn't be, and moving from severity-based to risk-based patch prioritisation, so effort flows to the vulnerabilities that genuinely threaten your organisation rather than the loudest CVSS scores. Attendees will leave with a clear-eyed view of how quickly the ground is shifting and a practical framework for reassessing exposure and patching strategy before the zero-day clock runs down to zero.

Most conversations about AI and security focus on defending against it. This one flips the lens: how do you use it? Hosted by a practising CISO, this closed-door discussion gets specific about where AI is genuinely earning its place in the security function, from accelerating policy development and review, to triaging and prioritising vulnerabilities against an unmanageable backlog, to compressing the timeline from detection to containment during live incident response.

Expect an honest exchange about what has worked, what over-promised, and what it takes to trust an AI-assisted output when the stakes are high. You'll leave with peer-tested use cases you can pilot immediately, a realistic view of the effort behind each, and a candid account of the failure modes worth avoiding.

Enterprises are rapidly establishing controls around AI models, platforms and prompts, but agents ultimately operate inside applications, inheriting their identities, credentials, permissions and existing security debt.

This session introduces a practical framework for assessing whether the enterprise application estate is ready for agentic access. Attendees will learn how to identify the highest-risk destinations, evaluate identity and credential hygiene, establish ownership and auditability, and operationalize a phased path toward secure AI adoption, without slowing innovation.

Benchmark where AI is delivering measurable value right now across three key fronts that define the modern security operation: the policies and guardrails that let your teams use AI confidently without creating tomorrow's incident, AI-assisted vulnerability management that prioritizes by real risk rather than raw severity in an environment producing more CVEs than any team can patch, and incident response that uses AI to compress detection, triage and containment when the adversary is automated and the clock is measured in minutes.

Participants will leave with a clear-eyed view of what peers are actually deploying versus what remains vendor promise, a sense of where their own programme leads or lags, and a shortlist of practical moves to take home: the policies worth writing, the use cases worth funding, and the ones worth leaving on the shelf for now.

Cyber insurance has quietly become one of the toughest audits a CISO faces. Underwriters now probe MFA coverage, EDR deployment, privileged access, backup isolation and incident response readiness in forensic detail, renewal questionnaires have become attestations with real legal weight, and a control you claimed but couldn't evidence can mean a denied claim at the worst possible moment.

Led by former insurer, this roundtable offers a genuine peek behind the curtain: how carriers actually read your application, which controls move the premium and which merely tick boxes, where policyholders most often misrepresent their estate without realising it, and what claims teams look for when deciding whether you're covered. Working under Chatham House rule, participants will benchmark how peers are aligning their security roadmaps with underwriting expectations, and leave knowing how to prepare for their next renewal or audit with evidence rather than assertions, how to manage the estate so coverage terms improve rather than erode, and how to make sure the policy they're paying for is one that will actually respond.

Frontier AI has not created a new risk; it has removed time from every risk you already carry. The tempo has changed, the threat and risk of multiple attack vectors in an attack path now exists, and the capabilities of models continues to grow exponentially. Join this session to learn how you can leverage frontier AI to strengthn the case for faster delivery of the security projects you already fund, and how you can make the case internally.

Global scale and local control pull in opposite directions, and data sovereignty rules keep tightening the vice. This session examines how organizations are running genuinely global cloud platforms while satisfying an expanding patchwork of residency, privacy and regulatory requirements, without fragmenting into a dozen incompatible regional estates.

It covers architectural patterns that keep sovereignty manageable, the governance model that makes multi-jurisdiction operation sustainable, and where centralization is worth defending against local pressure. You'll take away a practical view of the sovereignty decisions coming down the track and how to design for them now rather than retrofitting later. / Cyber insurance has quietly become one of the toughest audits your security program faces: premiums are priced on proof, questionnaires have hardened into interrogations, and when an incident lands, the payout hinges on evidencing that the controls you claimed were actually working on the day. Led from the insurer's side of the table by a leader with deep experience of how carriers really assess risk, this roundtable gets specific about what underwriters look for and where claims come unstuck. Participants will benchmark their own readiness against peers under the Chatham House Rule and leave with a clear-eyed view of the controls that move premiums, the evidence worth maintaining before you ever need it, and a practical path to an estate that stands up to scrutiny from insurers, and by extension regulators and boards, on its worst day rather than its best.

That's one tight paragraph given it's a roundtable rather than a full workshop. If this is the Arch (ex-AIG) SVP session from your Surinder call, send me his name and I can slot it in where "a leader with deep experience" sits; a named insurer-side voice makes this one considerably more magnetic.

Buying a gym membership doesn't make you healthy, and buying a tool, writing a process or hiring a team doesn't make your security effective. Only daily practice, measured continuously, does. Surinder Singh Rait leads Global IT Security Assurance at Ericsson, whose networks carry more than half the world's telecom traffic, and his remit is deceptively simple to state and brutally hard to execute: prove to management, boards, regulators, insurers and customers that security actually works.

In this keynote, Surinder shares the four-year journey from standing up a unit that didn't exist to a fully automated assurance capability spanning attack surface management, supply chain security, frameworks from NIST to NIS-2, and real-time control oversight through a single data lake, validating every control, every day, across 180 countries. You will leave with a practical blueprint for building assurance into your own program at whatever scale you operate: how to move from point-in-time audits to continuous evidence, what insurers and regulators actually ask for on the day things go wrong, and how to answer the hardest question a security leader faces, because breaches are not a matter of if but when: "how do we know it's working?

Legacy platforms are where security debt compounds quietly, in unpatchable systems, scarce skills, and controls bolted on decades after the architecture was set. This session tells the story of a multi-year legacy exit that actually finished and actually paid back: how the business case was built and defended across budget cycles, how risk was managed during the long middle period when both old and new ran in parallel, and what the security posture looked like on the other side.

You'll take away a migration approach that survives leadership changes, the arguments that unlock funding for work with no visible feature output, and the risk-reduction case for finally tackling the system everyone has learned to live with.

Continuing your mission tracks, having built the blueprint we now enter the reckoning – a decisive phase where insights are rigorously challenged and crystallised into solution-led outcomes.

Track 1: Securing AI at Scale: Enabling Innovation Without Introducing Unmanageable Risk
Track 2: Identity Security: Defending the New Enterprise Perimeter
Track 3 Your Perimeter Is a Myth: Managing Third-Party Risk in an Interconnected Digital Ecosystem

AI, digital transformation and an ever-expanding technology estate are pulling security leaders' attention in a dozen directions at once, and it has never been easier to lose sight of the fundamentals that actually determine whether an organisation suffers a material cyber incident. In this opening keynote, Kemas Ohale, CISO of Lippert, makes the case for stepping back and asking the questions every executive should be able to answer: do we truly know all the ways the business is interacting with technology, how our technology teams are implementing it, and whether our security function can detect and respond to the threats that transformation creates?

Drawing on his experience embedding zero trust as an overarching strategy rather than a point solution, Kemas explores how disciplined execution of the foundations becomes a business enabler, sharpens the conversation with the board, and drives the cultural shift that turns security from a race to keep up into a platform for confident innovation. Attendees will leave with a practical lens for auditing their own foundations and a framing that earns executive buy-in for getting the basics brilliantly right.

Most enterprises have finished migrating and are now living with the result: sprawling estates, unclear ownership, costs that grow faster than usage and a security posture stretched across environments nobody fully maps.

This session is about the phase after migration, namely consolidating, governing and turning a scattered cloud footprint into genuine operating leverage. It covers the visibility and ownership models that make sprawl manageable, where consolidation delivers both cost and risk benefits, and how to make the case for cleanup work that doesn't ship features. You'll leave with a diagnostic for your own estate and a prioritised set of moves that reduce exposure and spend at the same time.

Most security organizations are structured to absorb attacks. Golan Ben-Oni has spent two decades proving there is another way. As CIO and CISO of IDT Corporation; a role spanning seven verticals from telecoms to fintech, Golan runs one of the most distinctive strategic offensive security programs in the private sector: actively pursuing the state-sponsored threat actors targeting his business, in coordination with partners including Palo Alto Networks, SentinelOne, Mandiant and Microsoft.

From the operation against Russian state actors that made the front page of The New York Times in 2017 to the takedown campaigns he is leading today, this closed-door case study examines what it really takes for a defender to play both sides of the court: when offense is a legitimate and necessary component of defense, how to build the ecosystem and legal partnerships that make it possible, and why collaboration — even with direct competitors — is now a survival requirement. Woven throughout is the tension every leader in the room is living with: driving the AI adoption a legacy enterprise needs to stay alive over the next five years, while denying that same technology to the adversaries working around the clock to get in.