Advanced artificial intelligence capabilities have fundamentally compressed the time between vulnerability disclosure and active weaponization. Adversaries can now automate exploitation techniques to immediate and wide effect, turning newly discovered security flaws into active threats in hours rather than weeks. Recognizing that uniform, compliance-based approaches to patching can no longer scale to meet this reality, new mandates and executive orders emphasize the immediate prioritization of cyber defense against AI-driven risks across public sector organizations.

To meet the challenges of this shifting AI-threat landscape, public sector organizations must move toward a unified view of enterprise risk. This requires connecting previously siloed tools covering cloud infrastructure, connected on-premises servers, and external attack surfaces into a single operational plane.

This session explores how to:

• Leverage a unified Cloud-Native Application Protection Platform (CNAPP) approach to solve the complex hybrid exposure problem across legacy and modern environments.
• Integrate telemetry from existing vulnerability scanners and on-premises systems into Wiz’s Unified Vulnerability Management (UVM), translating disconnected point-solution data into centralized architectural context.
• Utilize Attack Surface Management (ASM) network path analysis to verify actual internet reachability, allowing agencies to safely implement isolating controls and extend mandatory compliance windows.
• Deploy full-stack workload visibility and identity analytics to automate remediation timeline assessments, map blast radius, track lateral movement, identify true asset ownership, and accelerate targeted forensic investigations.

Need a capability you don't have today? You're in good company. From March 30 to Sept. 29, 54% of the security vendor-selection requests IANS handled started with a capability gap, and AI adoption drove 29%.

AJ King and Dave Shackleford, both IANS Faculty, show you how to turn that need into a defensible shortlist without burning cycles on vendors that don't fit. They cover the pre-work, RFP, proof of concept (PoC), and customer reference steps that separate opinion from evidence. You'll learn how to:

• Define the gap, budget, owner, and must-have requirements before you talk to a vendor
• Run an RFP and PoC with standardized scoring and realistic lab conditions
• Separate "AI-powered" from "AI security," and test AI claims instead of taking them at face value
• Pick, back-channel, and score customer references to hear what a vendor-curated list won't tell you

Article 14 of the EU Cyber Resilience Act is active law, holding CISOs accountable for software supply chain risks across connected operational networks. Forward-thinking security leaders are turning this regulatory mandate into a competitive edge by transforming supply chain visibility into long-term operational resilience. Organisations deploying automated visibility eliminate blind spots while saving up to €15 million (£13 million) in potential non-compliance penalties.

Key takeaways for senior security leaders:

• Convert CRA visibility requirements into stronger cyber-physical network uptime before full 2027 enforcement.
• Automate 24-hour incident reporting workflows to streamline compliance without burdening operational teams.
• Eliminate hidden OT supply chain risks that traditional IT vulnerability tools consistently miss.

Aligning your supply chain strategy today turns regulatory pressure into an operational advantage that ensures future production.

AI agents are moving into security operations faster than most organizations can answer a basic question: Can we trust our agents to work as expected when AI-fueled attacks hit?

A successful demo of agent performance isn’t proof. Neither is a static dataset, tabletop exercise, or vendor benchmark. Agents behave differently when they encounter real systems, identities, tools, users, and adversaries—and those conditions continuously change after deployment.

Join Marcus Hutchins, Principal Threat Researcher at Expel and Lee Rossey, Co-Founder and CTO at SimSpace, as they explore how to prove performance before—and after—production.

Attendees will learn how to:

• Prove AI agents before (and after) production by continuously testing them under realistic attack conditions.
• Move beyond scripted demos and static testing to see how agents perform within real-world systems and workflows.
• Expose hidden failure points across agents, security tools, processes, and human-AI handoffs.
• Generate evidence of AI readiness to support more informed deployment decisions.

Don’t make production your proving grounds. Learn how preemptive cyber simulation can help organizations test what happens when AI meets the real world.

Strengthen network boundaries and maintain control as AI accelerates threats and infrastructure change with centralized visibility, continuous segmentation validation, and governed policy automation.

AI is accelerating attackers’ ability to identify security gaps, compromise entry points, and move through environments before manual processes can respond. When an identity, endpoint, or workload is compromised, the network becomes a critical line of defense—determining what the attacker can reach and how far the attack can spread. Clearly defined boundaries and consistently enforced segmentation will contain that movement and protect critical assets.

At the same time, AI coding agents and AI-driven operations are increasing the speed and volume of network changes. AI-driven operations are also increasing the speed and volume of network changes. Across firewalls, cloud, SASE, and microsegmentation, policies are often managed through separate tools—raising the risk of policy drift, segmentation gaps, and overly permissive access. Without a unified view, manual reviews and point-in-time audits cannot keep pace.

In this webinar, Erez Tadmor, Global Field CTO at Tufin, will show how security teams can stay in control. You’ll learn how a unified approach to network security posture management can provide centralized visibility, continuously validate segmentation and policy intent, evaluate risk before changes are implemented, and govern policy changes across complex hybrid networks.

Attendees will learn how to:

• Gain a centralized view of security policy across hybrid, multi-vendor environments
• Identify policy drift and inconsistencies across different enforcement points
• Continuously validate segmentation and security policy against intended controls
• Evaluate the risk and potential impact of network changes before implementation
• Automate policy changes while maintaining governance and compliance
• Produce audit-ready evidence that security controls are working as intended

The attacks are faster and so are the change requests. Security teams that can see, validate, and govern network policy in one place can keep up with both, without choosing between exposure and delay.

Critical infrastructure policy and enterprise cybersecurity are undergoing a fundamental transformation. For years, organizational strategy centered heavily on perimeter defense, vulnerability identification, and static compliance checklists. However, modern threat dynamics and tightening global regulatory frameworks are forcing leaders to confront an urgent operational reality: What happens when a critical security control fails or an attacker bypasses the perimeter?

Sweeping global mandates—including mandatory CIRCIA incident reporting in the U.S., EU NIS2 risk-management obligations across critical sectors, and the EU Cyber Resilience Act (CRA) establishing upstream manufacturer accountability—demonstrate that continuous cyber resilience is no longer optional. Proving that a security control was installed at a single point in time is no longer sufficient; organizations must maintain continuous visibility into control health, detect silent degradation instantly, and recover critical systems at machine speed.

Join Absolute Security and OpenPolicy for an executive thought leadership session examining the intersection of policy evolution, enterprise risk, and cutting-edge autonomous technology. Featuring independent policy and regulatory intelligence alongside enterprise security leadership, this session explores how organizations can bridge the gap between regulatory intent and technical execution. We will also examine recent breakthroughs in Agentic Resilience—highlighting how Absolute and NVIDIA are collaborating to give AI agents the embedded control, visibility, and authority needed to mitigate failures and stop downtime safely at scale.

AI adoption is accelerating across APAC, but securing AI is becoming more than a technology challenge. As organizations move AI from experimentation into production, security leaders must answer a harder question: Can we prove our AI is secure, governed, and continuously managed?

Policies and questionnaires alone cannot provide that proof. Organizations need visibility across AI assets, configurations, applications, models, agents, and runtime environments, along with evidence that security controls continue to work as risks evolve.

Join Qualys experts to explore how organizations can build an evidence-based AI governance program from code to runtime, connecting AI security with continuous risk management, regulatory expectations, customer assurance, and executive oversight.

Discover how to turn fragmented AI security signals into measurable risk and actionable governance.

What You'll Learn

• How to establish visibility across AI assets, models, applications, and agents.
• How to continuously identify, assess, and prioritize AI-related security risks.
• How to connect AI security controls with governance and compliance requirements.
• How to generate evidence for NIST, EU AI Act, customer questionnaires, and executive oversight.
• How to move from fragmented AI security signals to measurable, actionable AI risk management.

As enterprise AI adoption accelerates, organizations are realizing that the biggest challenge is proving that it's secure. The industry is rapidly shifting. Security alone is no longer enough; today’s AI initiatives are driven by strict governance, emerging compliance regulations, and the overwhelming burden of complex vendor questionnaires.

Organizations need continuous technical evidence showing what AI they use, how it is configured, whether models and agents can be exploited, what risks require remediation and whether controls continue to work after deployment.

Join us for this session where Qualys experts discuss how you can turn fragmented AI security signals into AI governance and risk management that is measurable, evidence-based.

Key takeaways

• What a governable AI programme needs beyond policy and questionnaires.
• How to operationalize continuous AI risk management across the AI lifecycle.
• How to achieve visibility into AI assets and assess AI risk, consolidated in one place.
• How to satisfy NIST, the EU AI Act, customer questionnaires, board oversight and endless vendor questionnaire.

As enterprise AI adoption accelerates, organizations are realizing that the biggest challenge is proving that it's secure. The industry is rapidly shifting. Security alone is no longer enough; today’s AI initiatives are driven by strict governance, emerging compliance regulations, and the overwhelming burden of complex vendor questionnaires.

Organizations need continuous technical evidence showing what AI they use, how it is configured, whether models and agents can be exploited, what risks require remediation and whether controls continue to work after deployment.

Join us for this session where Qualys experts discuss how you can turn fragmented AI security signals into AI governance and risk management that is measurable, evidence-based.

Key takeaways

• What a governable AI programme needs beyond policy and questionnaires.
• How to operationalize continuous AI risk management across the AI lifecycle.
• How to achieve visibility into AI assets and assess AI risk, consolidated in one place.
• How to satisfy NIST, the EU AI Act, customer questionnaires, board oversight and endless vendor questionnaire.

A successful exploit doesn’t automatically become a successful breach. After gaining a foothold, an attacker still needs ways to execute commands, retrieve tooling, communicate externally, establish persistence, and move further into the environment.

In this practical session, we’ll look at how Windows endpoint hardening can disrupt those next steps by reducing capabilities users don’t actually need. We’ll examine commonly abused Windows utilities, execution paths, Internet access, and communication channels that can make a compromised endpoint more useful to an attacker.

You’ll learn:

• Which Windows capabilities attackers commonly rely on after exploitation
• How to identify and restrict unnecessary execution, connectivity, and communication
• How to apply role-based hardening without unnecessarily disrupting users
• Why hardening and rapid vulnerability remediation work best together

The goal isn’t perfect prevention. It’s to make the path from foothold to meaningful compromise slower, noisier, and harder to complete.

AI dominated cybersecurity conversations in 2026. But when OSec looked at what actually created exploitable risk across more than 32,000 validated vulnerabilities, the story was far less futuristic.

The most consequential weaknesses were familiar ones: identity failures, insecure configurations, outdated software, missing protections, and seemingly minor issues that became dangerous when chained together. AI may be increasing the speed and volume of attacks, but it has not replaced the fundamentals of how organizations get compromised.

In this webinar, OSec will examine what its teams actually saw across client environments in 2026, including which vulnerabilities were most exploitable, where remediation broke down, and why traditional severity scores often fail to reflect real-world risk. We’ll also discuss what these findings mean for 2027 priorities, from identity and external attack surface visibility to third-party access and testing complete attack paths rather than isolated findings.

When adversaries use machine-generated attack chains to exploit blind spots in AI tools and agents, legacy defenses fail. To stop these automated threats, your prevention must be just as autonomous.

Join this session to discover how Agentic Endpoint Security (AES), built on Koi technology, secures the agentic ecosystem, neutralizes stealthy behavior in real time, and breaks the attack lifecycle of the most advanced AI-driven threats.

Most organizations measure cyber risk the way they always have—periodic assessments, annual reviews, and point-in-time snapshots that were outdated before the ink dried. The problem isn't that risk management frameworks are wrong. It's that they were built for an environment where risk moved slowly enough to measure on a schedule. That environment is gone. Cloud adoption, third-party dependencies, and expanding attack surfaces are creating new exposure faster than periodic programs can track. Risk programs that can't keep pace with continuous change aren't managing risk. They're documenting it after the fact.

See how security and risk teams are closing the gap between risk measurement and risk reality.

AI agents are moving into security operations faster than most organizations can answer a basic question: Can we trust our agents to work as expected when AI-fueled attacks hit?

A successful demo of agent performance isn’t proof. Neither is a static dataset, tabletop exercise, or vendor benchmark. Agents behave differently when they encounter real systems, identities, tools, users, and adversaries—and those conditions continuously change after deployment.

Join Rowan Curran, Principal Analyst at Forrester and Lee Rossey, Co-Founder and CTO at SimSpace, as they explore how to prove performance before—and after—production.

Attendees will learn how to:

• Prove AI agents before (and after) production by continuously testing them under realistic attack conditions.
• Move beyond scripted demos and static testing to see how agents perform within real-world systems and workflows.
• Expose hidden failure points across agents, security tools, processes, and human-AI handoffs.
• Generate evidence of AI readiness to support more informed deployment decisions.

Don’t make production your proving grounds. Learn how preemptive cyber simulation can help organizations test what happens when AI meets the real world.

The latest frontier AI models are changing cyber risk faster than traditional defenses can adapt. During this webinar, our Palo Alto Networks expert will break down how these new models can find and exploit exposures that have gone undetected for years and the implications for security leaders.

This session examines how the threat landscape has hit an inflection point, with work that once took deep expertise, time and manual effort happening in seconds at machine scale. Our expert will discuss what leaders need to prioritize now to reduce exposure before attackers put these capabilities to broader use.

• Exploit time compression: How frontier AI models are shrinking the time from vulnerability discovery to exploitation from months to minutes.
• The biggest risks today: The most immediate risks created by sophisticated, automated attacks at scale.
• Immediate actions to take: Practical guidance on what leaders should do now.

AI is changing the attack surface, empowering the attacker, and increasing the blast radius faster than traditional assessment cycles were designed to handle. As a result, security posture can no longer be assessed by periodic point-in-time reports. Practitioners must adopt an approach that combines discovery and exposure reduction with detection and response into a continuous feedback loop.

This session explores how security teams can connect these functions into a closed-loop operating model that continuously adapts to change. The objective isn't zero risk. It's reducing exposure continuously and shrinking the time between something changing, something going wrong, and action.

• The Problem - Frontier AI Breaks the Old Cadence
• Why Point-in-Time Assessments Fail
• Continuous Exposure Management: Finding and Reducing Risk
• Why Exposure Reduction Alone Isn't Enough
• Continuous Detection & Response for an AI-Accelerated Threat Landscape
• The Combined Lifecycle - Continuous Exposure Reduction (left) + Continuous Detection & Response

"Reduce the risks you can control. Detect and respond fast to the threats you can't."

As enterprise infrastructure teams modernize their environments to optimize costs and avoid vendor lock-in, the shift toward multi-hypervisor architectures is accelerating. However, managing a hybrid estate often means juggling fragmented security tools, navigating complex migrations, and dealing with operational chaos. The most critical risk of all? The very real threat of unknowingly migrating dormant malware into your newly minted infrastructure.

You need a way to evolve your virtualization strategy without the cyber risk. This webinar demonstrates how Rubrik serves as your ultimate cyber safety net, giving you the operational freedom to adopt new hypervisors confidently. We will show you how to decouple your data security from the underlying hypervisor, ensuring clean data mobility while protecting your entire estate. Join us to learn how to unify your defenses and modernize with absolute certainty.

What You Will Learn

Join us as we dive into the technical capabilities that enable a seamless, secure infrastructure evolution. You’ll learn how Rubrik can help you:

• Achieve Clean Data Mobility: Learn how to leverage proactive Threat Hunting to scan for and isolate hidden malware before you shift workloads, ensuring you only migrate clean data to your new environments.
• Decouple Security from the Hypervisor: Discover how abstracting your data protection layer gives you the agility to transition between hypervisors seamlessly, without compromising your security posture or creating new silos.
• Unify Your Hybrid Management: See how to apply, automate, and enforce consistent SLA policies across a diverse, multi-platform estate from a single, simplified control plane.