Security & Risk Forum

AEGIS Powers Trusted AI At Scale

Agentic AI is accelerating innovation, but it is also overwhelming leaders with fragmented frameworks, inconsistent guidance, and rising governance demands. The AEGIS framework cuts through this complexity, providing a unified, regulation-aware blueprint to help you govern AI systems and agents with clarity, accountability, and trust. In this hands-on workshop, you will learn how to align your AI governance strategy to core standards while addressing emerging risks from agentic architectures along with regulatory pressure. You will leave with a practical, scalable approach to governing AI that reduces complexity while strengthening trust and control across your organization.

Join this session to:

Simplify AI governance by aligning to a unified framework that maps to major regulatory and risk standards.
Move from fragmented, static policies to continuous, adaptive governance for AI systems and agents.
Prioritize high-impact controls and build a scalable foundation for trusted, compliant AI across the enterprise.

Speakers:
Enza Iannopollo, VP, Principal Analyst, Forrester

Kick Off Your Quantum Security Migration Journey

Quantum security migration will be one of the most significant security transformations your organization undertakes over the next few years, but the constantly changing timelines and evolving regulatory mandates make it difficult to take a breath and determine where to start. This workshop provides a practical framework for building a quantum security migration team, identifying critical dependencies, and managing risk across complex environments. Through guided exercises and discussion, attendees will leave with actionable steps for turning quantum security awareness into a coordinated plan.

Join this workshop to:

Identity your Q-day team.
Prioritize assets and systems for quantum security migration.
Surface third-party risks and develop key questions for your vendors and partners.

Speakers:
Sandy Carielli, VP, Principal Analyst, Forrester

AI Fundamentals

Mythos: Breaking Out of the Vulnerability Matrix

AI-led vulnerability discovery and exploit generation are rapidly reshaping cybersecurity. Capabilities once limited to elite researchers or nation-state actors are now being scaled for both defenders and adversaries, compressing the gap between discovery and weaponization. The implications extend beyond security operations, driving new questions around accountability, governance, and risk. Attendees will learn:

How organizations are adapting to this shift, where AI is outpacing traditional processes, and which new risks and bottlenecks are emerging.

How to identify AI-driven advantages and address asymmetric risks.

How to align roles, metrics, and investments to operate at machine speed.

Speakers:
Erik Nost, Senior Analyst, Forrester
Janet Worthington, Senior Analyst, Forrester

2:10 pm – 3:10 pm EST

Deep Dives

Minimum Viable Zero Trust

Organizations beginning or advancing Zero Trust initiatives often struggle due to limited budgets, organizational misalignment, and uncertainty about where or how to begin. Achieving Zero Trust does not necessarily require a massive technology investment or organizational overhaul. You can make meaningful progress by adopting a pragmatic, high-impact approach focused on risk reduction while building a foundation for longer-term maturity. This session will explore implementing minimum viable Zero Trust to deliver measurable security improvement through existing investments, operational changes, and governance.

Attendees will learn how to:

Use existing infrastructure as the foundation for a modern Zero Trust architecture.
Conduct a gap analysis to prioritize low-cost, high-impact investments and activities to improve Zero Trust capabilities.
Build realistic roadmaps to continuously improve Zero Trust maturity.

Speakers:
James Plouffe, Principal Analyst, Forrester

Beyond The Human: Evolving Human Risk Management In The Agentic Era

Human risk management has moved security leaders beyond “training as the silver bullet” toward measurable, behavior-driven protection. But in the agentic era, the workforce is no longer exclusively human. AI agents act with increasing autonomy — and if we ignore their behaviors, we create blind spots. This session reframes HRM for a hybrid workforce, exploring how capabilities must evolve to detect cybersecurity behaviors across both people and agents, while keeping accountability firmly human.

What the impact of AI is on your workforce
How AI impacts human related breaches
How human risk management evolves in the agentic era

Speakers:
Madelein van der Hout, Senior Analyst, Forrester

AI Fundamentals

Mythos: Breaking Out of the Vulnerability Matrix (Session Repeat)

How organizations are adapting to this shift, where AI is outpacing traditional processes, and which new risks and bottlenecks are emerging.
How to identify AI-driven advantages and address asymmetric risks.
How to align roles, metrics, and investments to operate at machine speed.

Speakers:
Erik Nost, Senior Analyst, Forrester
Janet Worthington, Senior Analyst, Forrester

3:10 pm – 3:50 pm EST

Forrester Women's Leadership Program: Connect With Purpose

Join this interactive Forrester Women’s Leadership Program networking session to build meaningful connections and elevate how you show up as a leader. Through guided reflection and peer discussion, you’ll explore how to articulate your strengths, aspirations, and impact in a way that resonates beyond titles and roles. Designed to help you engage more intentionally, this session will strengthen how you connect with peers, leaders, and partners across the event.

Speakers:
Chioma Onwuanibe, VP, CIO Executive Partner, Forrester

3:10 pm – 3:50 pm EST

Coffee & Networking Break

Enjoy refreshments and snacks while networking with peers in the Partner Lounge.

3:50 pm – 4:15 pm EST

Welcome & Opening Remarks

Forrester CEO, George Colony and host Merritt Maxim will kick off the Forum keynotes with words of welcome and questions to keep in mind to help you get the most out of your Security & Risk Forum experience.

Speakers:
George Colony, CEO, Forrester
Merritt Maxim, VP, Research Director, Forrester

4:15 pm – 4:35 pm EST

Keynote: Trusted Autonomy Starts With Securing Intent

AI compresses decision cycles until controls built for human-paced systems can’t keep up, but autonomous systems won’t break security by ignoring instructions — they’ll break it by following instructions too literally, pursuing the wrong goal too efficiently, or turning helpful behavior into ungoverned power. CISOs now need to govern intent, not just access, data, prompts, or outcomes. This keynote introduces Forrester’s research on securing intent and gives security leaders a new model for classifying agent behavior, proving trust, and controlling autonomy before technically compliant systems create strategically unacceptable risk.

Speakers:
Jeff Pollard, VP, Principal Analyst, Forrester

4:35 pm – 4:55 pm EST

Guest Keynote: More Information To Come

4:55 pm – 5:05 pm EST

What’s Ahead: Making the Most Of Your Forum Experience

Following the opening keynote, our host, VP, Research Director Merritt Maxim, will highlight the key themes shaping the event and provide a roadmap to sessions, discussions, and networking opportunities. Learn how to navigate the agenda, connect with peers, and get the most value from your Forum experience.

Speakers:
Merritt Maxim, VP, Research Director, Forrester

5:05 pm – 6:00 pm EST

Welcome Reception

Join us for an opening night reception full of networking, fun, food and refreshments.

Tuesday Nov 10

8:30 am – 9:20 am EST

General Breakfast

8:30 am – 9:25 am EST

Veteran's Breakfast

We invite all those who have served or are currently serving our country to join us for a special appreciation breakfast.

8:30 am – 9:20 am EST

Get The Most From Forrester AI Breakfast

Forrester AI gets you trusted advice fast. Join this interactive breakfast session to understand how Forrester AI’s latest and upcoming features help you and your team quickly identify and act on Forrester’s critical research calls and advice.

Key takeaways:

Learn the different ways you can access Forrester AI’s trusted advice — and see which way is the best for you.
Review top use cases and prompts and how you can use them to make progress on your initiatives.
See the latest capabilities that differentiate the Forrester AI’s analyst-backed, transparent experience.

Speakers:
Doug Washburn, Vice President, Product Management, Forrester

9:30 am – 9:40 am EST

Welcome Remarks

Speakers:
Merritt Maxim, VP, Research Director, Forrester

9:40 am – 10:00 am EST

Keynote: Forge The Trusted Future

AI agents process data, make decisions, take actions, and pursue outcomes autonomously. In this new reality, security is essential but no longer sufficient to build trust. Explainability, accountability, and fairness are indispensable, yet only a governance model embedded in the runtime fabric of AI can deliver them. Too many governance models lack enforcement mechanisms and clear outcomes, making trust an elusive target. The key to success is extending the foundational principles of the AEGIS framework to AI governance models to manage risks beyond security. Join this session to identify who you must collaborate with, which steps you must take, and how to get started redefining AI governance through continuous risk management, least agency, and adaptable controls for the agentic era.

Speakers:
Enza Iannopollo, VP, Principal Analyst, Forrester

10:00 am – 10:20 am EST

Guest Keynote: More Information To Come

Speakers:
Sandy Carielli, VP, Principal Analyst, Forrester

10:20 am – 10:40 am EST

Keynote: Identity Context Is King

As agents begin taking autonomous actions, securing agentic identity becomes the foundation for ensuring that every action is trusted, governed, and secure. Access decisions must be driven by rich identity context that combines intent, risk, guardrails, operational realities, and regulatory expectations to guide agent behavior in real time. This keynote explains how to use dynamic identity context to deploy and secure agentic AI architectures at scale.

Speakers:
Andras Cser, VP, Principal Analyst, Forrester

10:45 am – 11:15 am EST

Coffee & Networking Break

Enjoy refreshments and snacks while networking with peers in the Partner Lounge.

10:50 am – 11:50 am EST

Workshop: Implementing Forrester’s AEGIS Framework

Agentic AI creates new opportunities and new exposures. Forrester’s AEGIS framework is intended to help organizations safely adopt agentic AI using three core principles and six different domains. This workshop will provide a deeper dive into AEGIS, helping practitioners better understand the framework as well as align it with their existing initiatives, processes, and architectures.

Attend this workshop to:

Understand the three core principles of AEGIS and how they relate to other cybersecurity principles.
Learn about key activities and outcomes related to each of the six AEGIS domains and how to incorporate them into existing processes and architectures.
Learn how the application of AEGIS enables compliance across multiple regulatory regimes.

Speakers:
James Plouffe, Principal Analyst, Forrester

11:15 am – 11:45 am EST

Breakout Sessions

The Rise Of The Trust And Assurance Organization

Generative and agentic AI are rewriting the CISO mandate from protector of systems to provider of trust and assurance. This shift demands a new operating model: restructured teams, new capabilities, and far deeper collaboration across the business. CISOs must also navigate the complexities of integrating agentic AI into their security programs. This session will delve into the transformative potential of agentic AI and its uses, implications, and challenges, helping security leaders:

Learn how AI is changing CISOs’ roles and organizational structures.

Prepare for evolving and merging functions, roles, and responsibilities.

Strengthen stakeholder management skills to align competing priorities across security, IT, legal, and the business.

Speakers:
Jess Burn, Principal Analyst, Forrester

Guardrails For Applications Using AEGIS

As organizations rapidly adopt AI in application architectures, the challenge extends beyond building intelligent systems to effectively governing them. Forrester’s AEGIS framework provides a structured approach to AI-enabled application security, yet many teams struggle to translate its principles into operational guardrails.

In this session, Janet Worthington explores how leading organizations are operationalizing AEGIS to establish robust guardrails throughout the application lifecycle. The focus is on embedding policy, automating enforcement, and creating feedback loops to ensure that AI-enabled applications remain aligned with security, risk, and compliance expectations at scale.

Attendees will learn how to:

Translate AEGIS principles into enforceable guardrails across development, deployment, and runtime environments.
Identify gaps between policy intent and technical implementation that create hidden risk exposure.
Align security, engineering, and governance stakeholders around shared accountability and measurable outcomes.

Speakers:
Janet Worthington, Senior Analyst, Forrester

Agent Vs. Agent: CNAPPs AI-SPM Uses AI Agents To Secure AI Agent Infrastructure

Cloud-native application protection platforms’ AI security posture management (AI-SPM) capabilities are becoming a strategic control point for securing enterprise AI at scale. As organizations adopt AI services, such as the Amazon Bedrock, Microsoft Foundry, and Google Gemini Enterprise platforms, security leaders need stronger visibility into misconfigurations, configuration drift, identity risks, and emerging governance gaps. This session examines the priorities for building an effective AI agent–aided AI-SPM program across people, process, and technology. It will outline how to reduce operational risk, improve regulatory readiness, strengthen oversight of AI environments, and deliver measurable business value through more resilient, compliant, and well-governed AI infrastructure.

Speakers:
Andras Cser, VP, Principal Analyst, Forrester

Analyst-Led Roundtables

Can You Trust AI To Patch Production?

Participate in an interactive conversation about the promises and risks of agentic remediation, including accountability, transparency, rollback, and organizational readiness.

Speakers:
Erik Nost, Senior Analyst, Forrester

AMA: Implementing Responsible AI In The Real World

The keynote laid out a new approach to governing AI agents, now it’s your turn to ask the questions. Join this interactive roundtable to dig into continuous risk management, least agency, adaptable controls, and the practical realities of putting Responsible AI into action. Bring your questions, emerging challenges, and real-world scenarios for a candid peer conversation.

Speakers:
Enza Iannopollo, VP, Principal Analyst, Forrester

Is Your Third-Party Risk Program Actually Working?

Let’s get honest about third-party risk: What’s delivering value, and what’s simply creating more work? Join your peers for a candid discussion about persistent TPRM challenges, lessons learned, and opportunities to build smarter, more scalable programs. Leave with practical ideas for turning third-party risk from a recurring headache into a business advantage.

Speakers:
Alla Valente, Principal Analyst, Forrester

11:55 am – 12:25 pm EST

Case Study Sessions

Leap Platform: Attack Surface - Defenders Need Multi-Layer Signals

Smaller security teams face a paradox: they fight the same threats as enterprises but lack the resources to see them clearly. This talk will:

Explore what nation-state or advanced actors are doing, along with the full range of attack vectors—from endpoints to sensitive data stores
How to detect them using real TTPs to show how behaviors surface across layers
Learn how to gain visibility, reduce noise, and expose attacker activity without overspending

Speakers:
Vikram Thakur, Technical Director, Enterprise Security Group, Broadcom

11:55 am – 12:25 pm EST

Analyst-Led Roundtables

Endpoint Wack-A-Mole: Protecting The Workspace In The World Of AI

Come one, come all to talk about which “mallets” of endpoint security can be effective in defending where your employees work throughout the AI spectrum of chatbots, frontier models, vibe coding, and agents

Speakers:
Paddy Harrington, Senior Analyst, Forrester

Operationalizing Threat Intelligence for Proactive Defense

Join a live discussion as we explore how organizations can operationalize threat intelligence to drive proactive security outcomes and strengthen their defenses.

Speakers:
Jitin Shabadu, Analyst, Forrester

Is Your IAM Program Ready for the Age of AI Agents?

Join security and IAM leaders to discuss how AI agents fit into existing IAM programs, what new identity security capabilities are emerging, and which identity security controls are proving most effective as organizations scale agent adoption.

Speakers:
Geoff Cairns, Principal Analyst, Forrester

12:35 pm – 1:05 pm EST

Breakout Sessions

You Don't Need AI to Defend Against AI

The abstract idea of “AI-powered attacks” is filling a lot of headlines and a lot of marketing copy — and much of the message is how you need AI to defend against AI. Like any threat assessment, practitioners must strike a balance between prioritizing the most likely and the most dangerous. This session will provide a brief overview of the AI-powered attacks observed in the wild, break down their tactics and techniques, and provide insights into how Zero Trust can help mitigate threats or contain potential damage.

Join this session to:

Learn the “what” and “how” of AI-powered attacks in the wild.
Understand how to apply Zero Trust principles to defend against this emerging class of attacks.

Speakers:
James Plouffe, Principal Analyst, Forrester

Contracts: AI Guardrails With Teeth

As AI adoption accelerates, policy alone is not a sufficient control. The real guardrails are contractual — the clauses that define, assign, and legally ensure transparency, accountability, and action across the third-party ecosystem. This session shows how to turn AI principles into enforceable obligations that satisfy regulatory expectations, protect the organization, and make “regulation by contract” a deliberate strategy rather than an accident of paperwork. If it’s not in the contract, it’s not an enforceable guardrail.

Join this session to learn:

Why contracts are the most underutilized tool in the risk tech stack.
Why regulatory ambiguity increases the value of contracts, especially in AI.
How to use contractual terms for AI transparency, accountability, and oversight.

Speakers:
Alla Valente, Principal Analyst, Forrester

From Least Privilege To Least Agency: IAM For Agentic Architectures

AI agents can act, adapt, and make decisions at machine speed, creating risks that traditional identity and access management (IAM) was never designed to address. Securing agentic architectures requires more than controlling access; it requires governing autonomy. This session explores why least privilege is no longer enough and how IAM must evolve for the agentic era.

Attendees will learn how to:

Distinguish least agency from least privilege and understand why both are required for agentic AI security.
Establish a modern identity security foundation for agentic AI.
Apply dynamic authorization, short-lived credentials, and identity risk signals to constrain agent behavior.

Speakers:
Geoff Cairns, Principal Analyst, Forrester

12:35 pm – 1:35 pm EST

Workshop: Advance Your Data Classification Program

Data classification programs often struggle to move from plans and policies to consistent adoption and enforcement. This workshop will help security and risk leaders work through a real, current classification challenge with peers facing similar issues, whether their organization is rebooting a stalled effort or improving an existing program. Through structured small group peer consulting, participants will leave with practical ideas and one specific action to try.

Join this workshop to:

Share and get targeted peer input on a specific data classification problem your organization is facing.
Learn how other organizations are addressing challenges at a stage of program maturity similar to your own.
Identify one practical step you can take in the next two weeks to move your program forward.

Speakers:
Heidi Shey, Principal Analyst, Forrester

1:05 pm – 2:20 pm EST

Networking Lunch

1:05 pm – 2:20 pm EST

Executive Leadership Exchange Lunch (Invite Only)

Join fellow Executive Leadership Exchange members for a lunch focused on candid conversation and meaningful connection. Exchange perspectives on shared priorities, leadership challenges, and the issues shaping today’s security and risk landscape. Leave with fresh insights and stronger connections to a trusted network of executive peers.

Speakers:
David Levine, VP, Executive Partner, Forrester

1:50 pm – 2:50 pm EST

Workshop: Reskilling Cybersecurity Teams For The Agentic Era

Generative and agentic AI are reshaping cybersecurity work and the skills that security teams need to remain effective. This workshop will help CISOs rethink upskilling, career paths, and role design so practitioners can supervise AI-assisted decisions, preserve human judgment, and build trust in security outcomes. Join this workshop to:

Define the cybersecurity skills that matter most in an AI-augmented operating model.
Redesign career paths as AI changes how practitioners build judgment and experience.
Build a reskilling strategy that supports trust, accountability, and resilience.

Speakers:
Jess Burn, Principal Analyst, Forrester

2:20 pm – 2:50 pm EST

Breakout Sessions

Token Economics: Security Budgets In The AI Age

AI won’t make cybersecurity cheaper by default. As agentic AI moves into security operations centers, security platforms, and autonomous workflows, CISOs face a new cost model built on inference tokens, AI credits, premium reasoning models, integration work, and unpredictable consumption. This session shows security leaders how to spot AI cost exposure, govern token consumption, and defend security budgets before overages, throttling, or unfunded agentic workloads create operational risk. Join this session to:

Decode how token pricing, AI credits, and agentic workflows reshape security budgets.
Govern consumption before AI-enabled security tools create the next cloud-cost surprise.
Defend security budgets as AI shifts cost, risk, and accountability across the enterprise.

Speakers:
Jeff Pollard, VP, Principal Analyst, Forrester

Be Ready Before AI Fails

Catastrophic failures of AI are reality, not fiction. Failures such as deleted production environments and data sources along with their backups have already happened. Even with proper guardrails, you need to plan and improve your organization’s ability to keep brand promises even when these AI incidents happen. Don’t let your organization be the next headline.

Join this session to learn:

Where AI catastrophic failures are likely to come from
When to move from planning to action for AI resilience
How to test your AI resilience capabilities

Speakers:
Amy DeMartine, VP, Senior Research Director, Forrester

From Human-Led To AI-Driven: The New Reality Of OT Security

The thought of introducing AI-driven automation into operational technology (OT) environments makes security teams cringe. Yet as attacks on business operations rise, AI can mean the difference between staying online and grinding to a halt. This session aims to help you:

Identify the risks from OT security gaps.
Understand where AI delivers value.
Chart a path to adopting AI while maintaining safe, reliable uptime.

Come to learn how AI isn’t replacing operators and analysts but empowering them.

Speakers:
Paddy Harrington, Senior Analyst, Forrester

Analyst-Led Roundtables

Government Roundtable

Details coming soon.

Speakers:
Chioma Onwuanibe, VP, CIO Executive Partner, Forrester

3:00 pm – 3:30 pm EST

Breakout Sessions

Get Value From Threat Intelligence With Agentic AI

Agentic systems have the potential to be a force multiplier for security teams by amplifying how threat intelligence is operationalized within SecOps. But the reality today is messy — AI agents are inconsistently defined and unevenly implemented, making it difficult to separate substance from marketing noise.

This session cuts through that confusion by bridging agentic AI with modern threat intelligence needs by highlighting high-value use cases (and what makes them high-value), exposing common pitfalls, and outlining how to design a meaningful AI agent. It also dives into testing and validation measures required to keep the outcomes of these systems reliable at scale. And most importantly, it helps security leaders understand how to measure ROI for AI-enabled outcomes. Attendees will gain insights they can use to prepare for the adoption of agentic capabilities, whether they arrive directly or are embedded within existing security solutions.

Speakers:
Jitin Shabadu, Analyst, Forrester

Defending Against Rogue Agents With AEGIS

AI agents are proliferating across enterprises. These agents hold credentials, access sensitive systems, and execute actions without human intervention. They are the new insider threat surface. Detection technology and tactics, however, have not kept pace. This talk breaks down the threat management domain of the AEGIS framework to reduce the risk posed by AI agents of all kinds: those managed by the organization and those not.

Join this session to:

Discover technologies and techniques for monitoring agents, collecting telemetry, and baselining behavior.
Understand how to detect and respond to agentic AI threats as part of the AEGIS framework.

Speakers:
Joseph Blankenship, VP, Research Director, Forrester
Allie Mellen, Principal Analyst, Forrester