The average attacker now moves from a first foothold to the rest of the network in about 29 minutes. At the same moment, money itself is speeding up. US securities now settle in a single day, instant payment rails clear around the clock, and a fraudulent transfer can be gone long before anyone notices it was ever approved.

This opening keynote looks at what happens when both clocks collapse at once. Why the gap between detection and irreversible loss is shrinking for banks, insurers and every company that moves money through New York, which controls buy back the most time, and how security, fraud and treasury teams can finally work as one defense instead of three.

We spent twenty years learning how to trust people with access. We screen them, onboard them, give them only what they need, review their work and collect the badge on their last day. AI agents are now joining the workforce, often hired by a business unit that forgot to tell security, and most of them never go through any of those steps.

This panel borrows the employee lifecycle and applies it to digital workers, one stage at a time. Who approves the hire, how an agent gets its badge and its manager, what a performance review looks like for software, and how to retire an agent cleanly so its access does not outlive its purpose. Expect honest stories, the controls that held up, and the ones that did not.

The browser used to be a window. Now it is becoming a worker. AI browsers and assistants can read a page, fill in a form, approve a request and complete a purchase on someone's behalf, and a single hidden instruction tucked inside a web page can redirect all of it.

In fifteen focused minutes, this session explains why the browser has become one of the most important places to defend, what prompt injection looks like when it meets real credentials, and which simple policies let your people enjoy the help without handing the keys to whoever wrote the page.

Insurers read the same headlines you do, and the questions on renewal forms are changing quickly. How many AI agents run in your environment? Who signed off on their permissions? Can you prove a human approved that payment? In New York the stakes are already personal. Under the state's cybersecurity regulation, the most senior executive and the CISO of a covered company sign an annual statement of compliance, and any ransom payment must be reported to the regulator within 24 hours.

This panel brings together security leaders, risk owners and the people who underwrite them for a frank conversation about coverage, exclusions and accountability in the age of autonomous systems. Leave knowing what your carrier will ask next, what your AI vendor contracts should say, and how to make sure the fine print protects you rather than surprises you.

For a long time, offensive security meant the annual penetration test, a thick report and a list of findings that was already out of date by the time anyone read it. AI has changed the economics on both sides. The same tools attackers use to probe your defenses around the clock are now in your hands too, and security leaders are investing in offense again with real urgency.

This session explores continuous, AI assisted red teaming. What it finds that traditional testing misses, how to run it safely against live systems, and how to turn a constant stream of findings into fixes instead of fatigue.

Third party risk used to mean vendors, contractors and the software they shipped. Today it also means the foundation models you call, the open weights your developers download, the plugins and connectors your agents rely on, and the data those models learned from. Each one is a link in a chain you did not forge yourself.

This disruptor session maps the new AI supply chain and shows how to inventory it, assess it and set sensible guardrails without bringing innovation to a halt.

New York companies run on global connections. Teams, suppliers, data centers and customers spread across dozens of countries, and every one of those connections carries risk that starts far from Manhattan. A regional outage, a disruption at a key supplier, a sudden change in data rules or a wave of attacks aimed at one industry can travel across the world and arrive in your logs before the morning news has caught up.

This panel helps security leaders see further. How to build threat intelligence that reflects where you actually operate, how to plan for the loss of a key supplier or region, and how to brief a board that wants to understand global risk in plain business terms. It is a conversation about preparation, so your organization is never the last to know.

Since November 2025, the final phase of New York's amended cybersecurity regulation has been in force. Covered companies must require multifactor authentication for every user, keep a maintained inventory of every system, and accept that responsibility for compliance cannot be handed off to vendors or managed service providers.

This short session shares what the first year and more under these rules has revealed. Where examiners are looking, which gaps keep appearing, and why even companies outside the regulator's reach are adopting New York's playbook as their own baseline.

Every CISO carries a private library of moments. The breach that taught humility, the board meeting that changed how they speak, the hire that transformed a team, the warning they ignored once and never again. These stories rarely make it onto conference slides, yet they are where real wisdom lives.

This closing fireside invites seasoned security leaders to open that library. Honest, warm and practical, it is the conversation you usually only have late at night after an event, offered here to everyone in the room, especially those still writing the first chapters of their own careers.