Security Operations Transformation Summit

AI adoption is accelerating business operations, but it is also expanding the attack surface beyond the reach of traditional security models. While this enables speed and agility, it has expanded the attack surface faster than traditional security models can deliver protection.

This session examines how the evolving cybersecurity landscape is both driving progress and introducing new risks. We will outline practical strategies to build resilience and agility into security operations, enabling organizations to manage complexity at scale.

Steve Yates, Resilience Association Chairman and Liveryman of the Worshipful Company of Information Technology (WCIT), will address the real-world challenges organizations face in Security Operations Transformation. He will share actionable strategies for early risk detection, security management and building a resilient operational foundation.

Key Takeaways:
- Assess interoperable security models and automation strategies.
- Address attack surface fragmentation and close the budget maturity gap.
- Identify where operational complexity exceeds current skillsets and outline upskilling priorities for security teams.
- Examine executive perspectives on operational priorities amid a shifting threat landscape.
- Tackle key cybersecurity threats and operational resilience challenges head-on.

AI-driven applications, APIs, autonomous workflows, and digital workers are becoming active participants in business operations. As organizations increasingly rely on non-human actors to make decisions, execute transactions, and access sensitive data, the attack surface extends beyond traditional vendor boundaries.

When trust breaks down—through excessive permissions, model drift, compromised integrations, or unauthorized agent behavior—the consequences can include operational disruption, fraud, compliance failures, and reputational damage. Security operations must evolve from verifying who has access to continuously validating how AI-enabled systems behave and whether their actions align with business intent.

Traditional third-party assessments provide only a point-in-time view of risk. They offer limited visibility into the real-time actions of AI agents, SaaS extensions, and digital workers. As AI adoption accelerates, security teams need continuous, evidence-driven verification of both human and non-human identities.

Join Sandra Estok, Founder and CEO of Way2Protect, to explore a practical approach for extending security operations through continuous verification. Learn how to apply least privilege, implement runtime policy validation, establish accountability across suppliers and internal teams, and enable trusted AI innovation without sacrificing resilience.

Key Takeaways
- Understand why AI-enabled workflows challenge traditional third-party risk and supply chain security assumptions.
- Learn how to verify identity, authority, behavior, and outcomes across AI agents, digital workers, and interconnected systems.
- Apply practical guardrails including least privilege, runtime policy validation, continuous evidence, and human oversight.
- Establish clear accountability and escalation paths across suppliers, platforms, and internal teams.
- Leave with a practical blueprint for extending security operations to support trusted AI-enabled business ecosystems.

Google is committed to leading the AI revolution not only by building the best models, but also by building the best ecosystem for those models and agents to thrive. Join this session to learn how to build and deploy multi-agent systems using the Google Security Operations Model Context Protocol (MCP) server and Agent Development Kit. We will show you how you can create your own security agents, tailored to your organization’s unique needs, using Gemini Enterprise Agent Platform and the Agent2Agent protocol. Discover how you can supercharge your existing security tools and APIs with AI agents and enterprise-grade governance, observability, and scalability.

Security analysts need more than just technical skills to handle the realities of modern operations. AI, automation, and expanding attack surfaces have outpaced traditional training and certifications. As threats evolve, organizations face a critical skill gap: analysts need to be ready to make decisions and adapt under pressure, not just execute technical tasks.

Effective analysts do more than investigate alerts. They make informed decisions under pressure, align with business priorities, and collaborate across teams to drive incident response. To develop these capabilities, organizations need to move beyond technical training and intentionally build operational readiness.

Drawing on real-world experience leading enterprise security operations and vulnerability management programs, Mari Galloway shares practical strategies to develop analysts prepared for the moments that matter. Attendees will examine how experiential learning, cross-functional collaboration, leadership development and targeted technology adoption combine to build confident analysts and resilient security teams.

Learning Objectives
- Assess how AI and automation are redefining the analyst’s role, shifting focus from technical execution to operational decision-making.
- Learn practical strategies to develop operationally-ready analysts through experiential learning, cross-functional collaboration and real-world incident preparedness.
- Adopt leadership approaches that strengthen decision-making, communication and operational effectiveness so analysts can navigate complex incidents with confidence.
- Create development pathways that improve analyst retention, build organizational resilience and prepare the next generation of security operations professionals.

Cyber adversaries are moving faster, using automation and AI to overwhelm traditional defenses. Legacy SOC architectures cannot keep pace with the scale and speed of these attacks. As the enterprise attack surface expands, security leaders face a critical challenge: adapt their SOC strategy or risk falling behind. The surge of new tools promises solutions, but the real difficulty lies in pinpointing the technologies that will deliver measurable impact and understanding how to integrate them effectively.

Security leaders require a practical framework for technology selection that cuts through vendor claims and focuses on tools proven to reduce risk. This session examines how to strategically integrate advanced capabilities that align with compliance requirements, fit within complex environments, and support human analysts without adding to alert fatigue.

Join Charles Kolodgy, Principal at Security Mindsets LLC, for guidance on how to modernize your SOC, optimize technology procurement, and build a more resilient, analyst-centered human-machine defense model.

Key Takeaways:
- Evaluate the real-world strengths and limitations of AI-driven defensive tools to inform objective procurement decisions.
- Align technology investments with your current security frameworks and the maturity of your incident response teams.
- Assess how new technologies impact SOC workflows, security frameworks, and operational maturity.
- Integrate intelligent automation into SOC workflows to support analysts, reduce burnout, and accelerate detection and response times.
- Prepare your SOC infrastructure for next-generation advancements, including agentic AI and proactive defense models.

The security industry is experiencing its "iPhone moment." For more than two decades, physical security ran a predictable playbook. Today, that legacy framework traps organizations in massive "hardware debt" -- consuming storage, energy, space, and hands-on maintenance no one wants -- all while capturing situations and near-misses after it is too late. Advanced cloud architecture and edge-AI are completely eliminating the centralized bottleneck, giving rise to intelligent AI orchestration layers that instantly transform standard cameras into proactive, real-time "video supervisors." Physical security is being rewritten by tools that can deploy custom video-AI agents tracking dwell time, enforcing PPE, collecting business intelligence, and flagging anomalies before harm occurs.

This structural shift has fundamentally flipped corporate expectations on their head. Integrators and security operators are no longer just field technicians; they have been thrust into the role of AI consultants.

The true differentiator for modern security leadership will not be the speed of deployment, but the caliber of data-driven governance. This session from CEO Robert Messer will deliver concrete guidance on how to move beyond legacy security mindsets, establish objective performance metrics that resonate with the C-suite, and confidently navigate the transition from capital-intensive on-premises hardware to secure, provable results in the cloud.

Security operations centers produce a lot of data, including alert counts, MTTR, MTTD, incident volumes, and automation rates. But does having all this information really make us safer?

As regulatory pressures and board oversight intensify, security leaders need to be able to translate daily operational work into strategic risk insights that executives actually understand. Without this, CISOs struggle to justify security budgets and demonstrate their value to the business. Traditional SecOps metrics like ticket closure rates and detection speeds only tell part of the story. Modern security leaders need frameworks that connect operational performance to exposure reduction, resilience building and strategic decision-making.

This session will show you how to turn raw security data into risk intelligence that makes sense to executives and boards. We’ll also look at how AI-driven automation is changing what we measure and helping organizations move away from reactive risk management, towards a proactive approach that supports smart investments and shared accountability.

Join Oksana Denesiuk, Board Member for ISSA LA and Senior Product Manager at Kaiser Permanente, to learn practical ways to improve your security operations reporting.

Key Takeaways:
- Why traditional SecOps metrics (alert volume, MTTR, MTTD) fail without business context.
- Practical frameworks for translating operational security data into risk intelligence that drives prioritization and investment decisions
- How AI and automation are transforming next-generation security operations, measurement and resilience strategies.
- Proven communication techniques CISOs use to present security performance meaningfully to boards and cross-functional stakeholders.
- Actionable methods to align SecOps metrics with exposure reduction, business impact, and organizational resilience goals.

In the age of AI, SIEM and EDR alone may not be enough. As attackers move faster and threats become more complex, real-time endpoint telemetry is becoming a critical foundation for modern SecOps.

With a live view across endpoints, security and IT teams can investigate faster, scope incidents more accurately, reduce dwell time, and respond at enterprise scale. That visibility also creates a stronger foundation for AI and automation, helping teams move from reactive alert handling toward more proactive, governed, and efficient operations.

Join Tanium for a practical conversation on how organizations can modernize security operations with real-time telemetry, AI-powered analysis, and automation that supports human expertise. The discussion will explore why modern SecOps requires more than detection alone, how teams can close the gap between attacker speed and defender readiness, and how unified visibility can improve response and business resilience.

In this webinar, you’ll learn how to:
- Modernize SecOps workflows for faster threat response
- Use real-time telemetry to reduce dwell time and improve containment
- Apply AI and automation to support faster, more governed decisions
- Strengthen collaboration across Security, IT, and business teams
- Demonstrate SecOps value through lower risk and greater resilience

The insights learned can help security leaders scale response, empower analysts, and prepare for an AI-driven threat landscape.

Automated tools miss the threats that cause the most damage. While threat hunting is essential for modern security operations, its value is often measured by the number of hunts completed—a metric that overlooks its true operational impact. Without a clear framework for demonstrating risk reduction and guiding detection engineering, SOC leaders struggle to justify investment and prioritize resources.

Security teams must adopt outcome-based measurement to capture the full value of threat hunting. This session outlines a practical approach for evaluating threat hunting with KPIs that matter: hypothesis quality, visibility gaps, adversary techniques addressed, and quantifiable risk reduction. These metrics directly inform improvements in MTTD, MTTR, dwell time, and false negatives. Learn how to translate technical hunting results into executive insights that demonstrate resilience gains and support a proactive SOC strategy.

Join John Bambenek, President of Bambenek Consulting, to discover proven methods for quantifying threat hunting value and securing the resources your team needs to advance.

Key Takeaways:
- Define outcome-based KPIs for threat hunting and eliminate vanity metrics.
- Connect hunt outcomes to risk posture by tracking MTTD, MTTR, dwell time, and false negative trends to justify investment.
- Audit and document hypothesis quality and coverage to improve efficiency.
- Present technical results in executive terms, highlighting cost avoidance and strategic roadmap impact.