The average attacker now moves from a first foothold to the rest of the network in about 29 minutes. In a region home to the nation's busiest port complex, major health systems, community banks and global online retailers, an hour offline is measured in containers, patients and orders. Yet in many organizations the decision to isolate a system, cut a supplier connection or take a revenue platform offline still waits for a meeting and an executive who may be on a plane.

This opening keynote looks at the human side of speed. Who holds the authority to act in the first half hour, what they are allowed to break without asking, and how leading CISOs agree those decision rights with the CEO, the business and the board long before the night they are needed. The fastest response, it turns out, is the decision that was already made.

For many organizations the most damaging attacks no longer target the company at all. They target its customers. Stolen passwords, hijacked sessions, convincing fake support calls and AI written phishing let criminals walk into real accounts, drain balances, redirect orders and leave the brand to absorb the anger and the losses.

This panel brings together security and fraud leaders from banking, retail and digital commerce to compare how they protect customer accounts without driving customers away. How to spot a takeover in progress, where stronger sign in methods are finally winning, how security and fraud teams can work as one, and how to talk to customers honestly when something goes wrong.

The browser used to be a window. Now it is becoming a worker. AI browsers and assistants can read a page, fill in a form, approve a request and complete a purchase on someone's behalf, and a single hidden instruction tucked inside a web page can redirect all of it.

In fifteen focused minutes, this session explains why the browser has become one of the most important places to defend, what prompt injection looks like when it meets real credentials, and which simple policies let your people enjoy the help without handing the keys to whoever wrote the page.

California has raised the bar for proving security, not just promising it. New rules from the state's privacy agency took effect in January 2026. Larger businesses must complete their first independent cybersecurity audit, covering 2027, and certify it by April 2028, while rules on automated decisionmaking apply from January 2027. At the same time, insurers are asking sharper questions at renewal. How many AI agents run in your environment? Who approved their permissions? Can you prove a human signed off on that payment?

This panel brings together security leaders, risk owners and the people who underwrite them for a frank conversation about audits, coverage and accountability in the age of autonomous systems. Leave knowing what your auditor and your carrier will ask next, what your AI vendor contracts should say, and how to make sure the fine print protects you rather than surprises you.

For a long time, offensive security meant the annual penetration test, a thick report and a list of findings that was already out of date by the time anyone read it. AI has changed the economics on both sides. The tools attackers use to probe your defenses around the clock are now in your hands too, and security leaders are investing in offense again with real urgency.

This session explores continuous, AI assisted red teaming. What it finds that traditional testing misses, how to run it safely against live systems, and how to turn a constant stream of findings into fixes instead of fatigue.

Third party risk used to mean vendors, contractors and the software they shipped. Today it also means the foundation models you call, the open weights your developers download, the plugins and connectors your agents rely on, and the data those models learned from. Each one is a link in a chain you did not forge yourself.

This disruptor session maps the new AI supply chain and shows how to inventory it, assess it and set sensible guardrails without bringing innovation to a halt.

Southern California is where much of America meets the Pacific. Cargo moves through its ports, data moves through subsea cables that land along its coast, and its companies run teams, suppliers, data centers and customers across the world. A regional outage, damage to a subsea cable, a disruption at a key supplier, a sudden change in data rules or a wave of attacks aimed at one industry can travel across the ocean and arrive in your logs before the morning news has caught up.

This panel helps security leaders see further. How to build threat intelligence that reflects where you actually operate, how to plan for the loss of a key supplier or region, and how to brief a board that wants to understand global risk in plain business terms. It is a conversation about preparation, so your organization is never the last to know.

For years the defense against ransomware was simple to explain. Keep good backups and you will never have to pay. Many criminal groups have adapted. They no longer bother to lock your systems. They copy your data, then threaten to publish it, contact your customers or alert your regulators, and no backup in the world makes that threat go away.

This short session looks at the rise of pure data extortion and what it changes for leaders. Where data protection matters more than recovery, how to learn quickly what was actually taken, and how to prepare communications for customers and regulators before the first message from the attackers arrives.

Every CISO carries a private library of moments. The breach that taught humility, the board meeting that changed how they speak, the hire that transformed a team, the warning they ignored once and never again. These stories rarely make it onto conference slides, yet they are where real wisdom lives.

This closing fireside invites seasoned security leaders to open that library. Honest, warm and practical, it is the conversation you usually only have late at night after an event, offered here to everyone in the room, especially those still writing the first chapters of their own careers.