Agenda

As AI agents become embedded across business workflows, they are gaining the ability to access data, interact with applications, and take action with increasing autonomy. While these capabilities can accelerate productivity, they also introduce new security challenges. An AI agent may have legitimate access to systems and data, yet still make decisions or take actions that create risk for the organization.

Join Proofpoint for this 45-minute breakout session examining how security teams can address the growing gap between AI access and AI control.

In this session, you’ll learn:

· How AI agents expand risk across enterprise applications, tools, and data

· Why visibility into AI activity is critical for effective governance

· Ways to reduce the risk of data exposure across prompts, responses, and automated workflows

· How guardrails and runtime protections help keep AI behavior aligned with business expectations

· Practical considerations for securing AI as adoption scales across the organization

Discover how organizations can gain greater visibility into AI activity, protect sensitive information, and establish the controls needed to confidently embrace autonomous AI.

Security governance for AI systems is stuck in 2015. GRC teams write PDF policies. Engineering teams ignore them. When a developer wants to connect a new tool to their AI agent, the review takes days. By the time the policy doc is updated, the architecture has changed twice.

This session presents a policy-as-code approach to AI governance that gives GRC teams direct control over runtime enforcement without requiring engineering deployments. Using OPA/Rego as the policy engine, governance rules become version-controlled, testable, and hot-reloadable artifacts that enforce at the point of action rather than the point of review.

The talk walks through real implementation: writing Rego policies that map to NIST 800-53 controls, building a policy bundle pipeline so GRC pushes updates without deployments, and separating policy ownership from infrastructure ownership so security teams and engineering teams stop blocking each other.

Key Learnings:

• Why document-based AI governance fails in fast-moving engineering organizations
• Implementing policy-as-code with OPA/Rego for AI agent runtime enforcement
• Mapping Rego policies to NIST 800-53 and ISO 27001 control families
• Building a GRC policy pipeline: version control, testing, hot-reload, and audit trails
• Organizational patterns for separating policy ownership from infrastructure deployment

Organizations are pivoting toward Agentic AI, which results in large-scale data misappropriation evolving from technical nuisance to board-level fiduciary crisis. Drawing on research submitted to the White House OSTP and the Purdue AI Management & Policy program, this session outlines a strategic blueprint for protecting proprietary data. Attendees will explore a Three-Pillar Defense: Technical Architecture, Product-Embedded Safeguards, and Policy-Driven Governance. This session bridges the gap between technical defense and executive risk reporting, providing a practitioner’s roadmap for operationalizing the NIST AI RMF to ensure long-term resilience and data integrity.

Attendees will gain a three-pillar strategic framework to reframe AI scraping as a board-level fiduciary risk while learning actionable steps to operationalize NIST AI RMF standards for long-term data integrity.

AI adoption inside organizations is accelerating faster than governance frameworks can keep up. While much of the conversation focuses on securing large language models and understanding how they work, many organizations are overlooking a more immediate risk: how AI tools are being introduced, accessed, and used across the business.

This session reframes AI governance through a familiar lens—Governance, Risk, and Compliance (GRC). Rather than treating AI as a completely new and undefined risk category, we explore how existing security and risk management practices can be effectively extended to AI tools and platforms.

Most organizations don’t need a brand-new AI governance framework—they need to operationalize the one they already have.

Attendees will learn how to evaluate AI solutions using practical, established criteria: encryption in transit and at rest, access controls, data handling practices, regulatory alignment (HIPAA, PCI, SOC 2, where applicable), and disaster recovery capabilities. The session walks through how to incorporate AI into vendor risk assessments, third-party risk management programs, and internal control frameworks—delivering a pragmatic approach for security and risk leaders who need to move quickly without reinventing their entire governance model.

Attendees will leave with a practical, immediately actionable framework for governing AI tools using the GRC practices they already have—so they can safely enable AI in their organizations without waiting for the industry to agree on a standard.

• Understand why AI governance should be integrated into existing GRC frameworks rather than treated as a separate discipline
• Learn how to apply traditional risk assessment methodologies to AI tools and platforms
• Identify key control areas for AI: encryption, access controls, compliance alignment, data governance, and operational resilience
• Incorporate AI tools into vendor risk management and third-party assessment programs
• Walk away with a practical framework to begin governing AI immediately—starting Monday morning

While adversaries rapidly weaponize AI, defenders are stalling. Despite 84% of security leaders agreeing that autonomous agents should be managing L1 alerts, a mere 22% trust the technology enough to hand over the keys for even the most basic tasks.

How do we break this deadlock before we fall permanently behind?

Join Tim Leehealey, Strike48 Co-Founder and VP of Strategy, as he deconstructs the AI trust barrier. You’ll discover a pragmatic path forward that favors steady, verifiable automation over risky overhauls.

Key Takeaways:

• Survey results on why security leaders survey don’t fully trust AI agents yet
• Why blind spots in data visibility amplify our distrust of autonomous agents
• A 5-step blueprint for incrementally introducing agents across your current stack
• How cross-team visibility (NOC, Observability, Compliance, etc) improves agent results

AI is changing the economics of cyber risk. Vulnerabilities can now be discovered, prioritized, and exploited faster than many organizations can validate their real exposure. A logs-only view is no longer enough because logs show only what systems report, not everything attackers can reach. The highest-risk gaps often sit in east-west traffic, encrypted sessions, fast-moving cloud and container environments, and unsanctioned AI services operating outside formal oversight. 

Attendees will learn how network telemetry provides the evidence needed to make better security decisions. It helps teams determine which vulnerabilities are truly exploitable, uncover lateral movement and shadow AI usage, and prioritize detection and remediation around the most critical attack paths. The outcome is not just faster action, but measurably lower cyber risk and stronger business resilience.

This session examines social engineering and AI jailbreaking as the same problem expressed through different systems: the deliberate use of language to move a target toward action. Instead of treating phishing, scams, and prompt attacks as separate disciplines, the presentation breaks them down into shared persuasion mechanics: authority, scarcity, liking, commitment, social proof, urgency, secrecy, and gradual escalation.

The course moves from the old confidence game to modern AI-enabled manipulation, showing how attackers recruit victims into a story before they ever ask for money, credentials, access, or action. It then bridges that human model into large language models, explaining how prompts, roleplay, indirect prompt injection, many-shot examples, semantic camouflage, and agentic tool use exploit similar weaknesses in machine behavior.

The goal is not just to define these attacks, but to make them recognizable in the moment. Participants will learn to identify pressure, authority claims, skipped verification, escalating requests, and manipulated context across both human communications and AI systems.

Artificial Intelligence is no longer just a driver of productivity; it is the primary battlefield of modern global conflict. This session connects the dots between geopolitical volatility and the immediate risks to model integrity, data sovereignty, and cognitive security. We will examine how shifting alliances involving major powers like Russia, China, and the EU are reshaping the cyber threat landscape—specifically targeting sovereign AI clusters, decentralized compute networks, and the global semiconductor supply chain.

The discussion will pivot to the “internal” evolution of the sector, analyzing the rapid integration of Agentic AI in critical infrastructure and the resulting “black box” regulatory and privacy minefield. From state-aligned actors seeking to poison training datasets to sophisticated syndicates deploying automated exploit-generation engines, we will profile the adversaries threatening the global digital order.

Join us for a 2026 outlook that moves beyond mere ethical frameworks, offering a battle-tested strategy for maintaining operational resilience and model alignment in the face of unprecedented global instability.