Beat the rush and join us early for complimentary barista-made coffee and breakfast.

The hardest data security problem right now is not protecting the databases you know about. It is finding every place AI has quietly copied what was inside them.

RAG pipelines, copilots, vector stores, evaluation sets, and AI-powered SaaS all duplicate, cache, and log sensitive data faster than most teams can map it. Much of that data lands in systems traditional security programs were never built to inspect.

This keynote is a practical look at how teams regain visibility across an AI-enabled environment. Where sensitive data turns up, which copies are hardest to pin down, and how to reduce the blind spots before they become part of the next breach.

We’ll cover:

• Where sensitive data now hides, from vector stores and prompt logs to evaluation sets and SaaS AI features
• How to discover and classify AI-created copies without slowing adoption
• Practical ways to remove, restrict, or protect exposed data before it becomes an incident

AI agents are no longer just answering questions. They’re accessing sensitive data, calling tools and taking action across enterprise systems. But are security teams keeping up?

Traditional security wasn’t built for AI that can interpret instructions, make decisions and act autonomously. From prompt injection and data leaks to excessive permissions and rogue actions, the risks are evolving faster than many organizations’ defenses.

In this keynote, Straiker will unpack where agentic AI creates new attack surfaces and how security teams can get ahead of them. Discover how to expose hidden risks, pressure-test agents against real-world attacks and enforce controls before agents make decisions that put data, systems or the business at risk.

We'll discuss:

• How AI agents create security gaps through tool access, excessive permissions and indirect prompt injection, and why traditional controls can miss them.
• Ways to uncover vulnerabilities, trace agent behavior and simulate real-world attacks before they lead to data exposure or unauthorized actions.
• How to enforce least-privilege access, monitor actions and set clear boundaries on what agents can see, decide and do, without putting the brakes on innovation.

Finding sensitive data is no longer enough. The harder question is whether you can prove it is governed.

Boards, auditors, and regulators want evidence. Who owns the data, who can reach it, how long it is kept, whether access is reviewed, and whether deletion really happened. In New York, this is moving from an operational expectation to signed accountability. Since November 1, 2025, DFS-covered entities have needed written policies for maintaining an inventory of their information systems, while annual Part 500 submissions are signed by the highest-ranking executive and the CISO.

This panel gets into what defensible data governance actually looks like, and why programs that stop at discovery often fall apart when someone asks for proof.

We’ll discuss:

• Moving from periodic discovery to continuous, evidence-based governance
• Proving retention, access reviews, and deletion are happening across cloud, legacy, and AI environments
• What senior leaders need to know before they put their names behind the organization’s controls

AI agents are now being spun up across SaaS tools, cloud environments and employee endpoints faster than security and privacy teams can review them. Most organizations can produce a list of approved AI tools, but few can say which agents are actually running, what data they touch, who owns them, and whether they should be trusted at all. Banning them doesn’t work either; it just pushes usage out of sight.

In this session, Kobi Nissan walks through how one organization went from an unknown agent footprint to a clear, defensible trust decision for every agent.

We'll look at:

• How to discover the AI agents, models and tools operating across endpoints, SaaS, identity and cloud, including the ones nobody approved
• How to judge each agent’s trustworthiness using business context (data sensitivity, purpose, ownership, vendor and policy) rather than technical signals alone
• How to turn that judgement into action: approving safe agents, remediating risky ones and restricting what shouldn’t move forward, with an audit trail to prove it

In this innovative session, attendees will be faced with a series of scenarios that they may face in their roles. Attendees will discuss the possible courses of action with their peers to consider the ramifications of each option before logging their own course of action.

‍

Results will be tallied and analyzed by our session facilitator and results will impact the way the group moves through the activity.

‍

Will we collectively choose the right course of action?

As facial images move freely across social platforms, dating apps, healthcare systems and banking profiles, they are also increasingly scraped and repurposed for unwanted facial recognition — through consumer apps, surveillance cameras and emerging AI-glasses. With biometric privacy legislation accelerating across US states and nations worldwide, any organization storing faces now carries real compliance exposure.

This session shares research into training AI models to subtly alter faces, making them unreadable to facial recognition systems while remaining fully recognizable to humans, and what this means for how companies should prepare.

• Understand the growing exposure created by storing facial images, as unauthorized scraping and facial recognition use outpaces how most organizations currently manage biometric data.
• Learn how adversarial AI techniques can alter faces just enough to defeat facial recognition algorithms while preserving human recognizability, without compromising the usability of the image itself.
• Prepare for a landscape of rising biometric privacy regulation and customer awareness, with practical steps companies can take now to stay ahead of both compliance requirements and public trust expectations.

Most teams think of AI data exposure as a search problem — find the copy, delete it, done. It isn't. A vector embedding is a derivative that behaves like your data: you can't search for it the way you'd search for a file, and deleting the source record doesn't remove it. Every eval set, cache, agent memory and vendor-side index adds another copy you'll never find that way.

Using the M365 Copilot rollout as the shared reference point, this session works through where the real leverage is: the decisions that create copies in the first place, not the cleanup afterward.

• Where copies actually get created — connector scope, index builds, retention defaults and derived-artifact deletion terms — and why these decisions matter more than any post-hoc search-and-delete effort.
• The two failure modes that keep showing up: permission inheritance that's technically correct but oversharing by synthesis, and source misconfiguration that was survivable before retrieval made it searchable in plain language.
• What to lock down before rollout, not after — using the M365 Copilot experience most of the room already lived through as the worked example.

Privacy and security protect the same data, but they do not start from the same question.

Privacy asks whether data should be collected, retained, or reused at all. Security asks who can reach it and how it should be protected. Once AI starts combining and repurposing enterprise data in ways nobody imagined when it was collected, those decisions can no longer be made in separate rooms.

This panel brings privacy and security leaders together to compare how they divide the work, where responsibilities overlap, and what happens when the two functions reach different conclusions.

We’ll discuss:

• How privacy and security divide ownership of minimization, retention, and deletion
• Preparing for new state privacy and AI rules without rebuilding controls market by market
• Telling one defensible story about your data practices to regulators, boards, and customers

Put your knowledge to the test in this fast-paced quiz covering real-world trivia, key concepts, and emerging trends. Compete for bragging rights—and a travel voucher—as the top scorer takes the crown.

Most enterprise Risk Appetite Statements are aspirational, qualitative policy documents that sit on a shelf until an auditor asks for them. They rarely tell a product team whether they can deploy an AI model, or tell procurement whether a vendor's risk profile is acceptable. Without real, quantitative inputs, leaders are left making reactive decisions in a vacuum.

This keynote explores how to turn the Risk Appetite Statement from static policy into a living, data-driven decision engine, feeding it integrated inputs across data privacy, information security, AI pipelines, and third-party ecosystems to transform abstract tolerance into clear thresholds that drive confident execution.

• How to feed your RAS quantitative, real-time inputs from across privacy, security, AI and third-party risk.
• How to convert abstract risk tolerance into concrete thresholds that give product and procurement clear go/no-go answers.
• How a living RAS shifts leaders from reactive decisions to confident, data-backed business execution.

As AI regulations multiply, many organizations are creating separate compliance programs for each new law. That approach is costly, slow, and difficult to sustain. This keynote explores how organizations can simplify compliance by building a single, high-standard control framework that meets multiple regulatory requirements at once. Learn how legal, privacy and security teams can work together to govern AI, reduce data risk, and create continuous evidence that stands up to regulators, boards and auditors.

• How to simplify overlapping AI, privacy and cybersecurity regulations with one unified compliance framework.
• Practical ways to govern AI data, reduce dark data, and strengthen data minimization.
• How to build continuous evidence of compliance that satisfies regulators, auditors and boards.

Most AI agent incidents won't look like hacks. Nobody steals a password and nobody exploits a zero-day. The agent just uses the access it was given, and data ends up somewhere it shouldn't. This session walks through three bad days at a fictional company, with live demos. On Day 1, a new hire's ordinary question leaks credentials into a company-wide channel, and there's no attacker at all. On Day 3, one edited wiki page makes the agent send customer records to an outside channel. On Day 14, a plug-in that was approved and scanned quietly changes what it does two weeks later. Under HIPAA and GDPR, each of these can still count as a reportable breach, because a breach is defined by unauthorized disclosure, not by someone breaking in.

The session shows why traditional security testing misses these cases, and what works better: take the decision away from the model and put a fixed policy check in front of every tool call. It also covers what that fix still doesn't solve.

We'll discuss:

• How agent permissions, trusted content and connected plug-ins can create new paths for sensitive data to leak.
• Why agents and third-party integrations need continuous review, monitoring and clear ownership as their behavior and access change.
• How to apply policy checks to every tool call, use individual identities, log agent activity and inspect outbound data, beyond relying on system prompts alone.

Most incident response plans assume you can trace what data was involved. AI breaks that assumption.

Sensitive information may now sit in prompt histories, vector stores, evaluation sets, temporary caches, and third-party AI services that were never included in the original data map. When an incident happens, the first and hardest question becomes what was actually exposed.

This think tank brings security, privacy, legal, and data protection engineering leaders together to work through how breach response changes when AI is involved. In New York, that can mean reconciling the SHIELD Act with NYDFS and SEC requirements, while determining whether encryption held and whether the keys were also compromised.

We’ll discuss:

• Scoping what was exposed when data has been copied far beyond production systems
• Making disclosure calls across NYDFS’s 72-hour requirement, the SEC’s four-business-day deadline once a public company determines an incident is material, the SHIELD Act, and other state regimes
• How encryption, tokenization, and masking change the real exposure, and how to prove those controls held after an incident