Security & Risk
Summit

Risk management is poised to undergo significant transformations driven by technological advancements, evolving regulatory landscapes, and the increasing complexity of global markets. Risk services, encompassing risk management, risk assessment, and risk mitigation strategies, are critical for businesses to navigate uncertainties and protect their assets when internal resources don’t have the expertise. This session will explore several key trends and factors shaping the future of risk management and how the evolution of risk services signals that future. You will learn:

• How market and industry risk profiles have evolved.
• How evolving risk profiles have adapted enterprise risk capabilities.
• How adapting enterprise risk capabilities require new risk-based competencies.

Speakers:
Christopher Gilchrist, Principal Analyst, Forrester

Threat actors are a good source of learning about our environments and how they can be attacked. They are also remarkably good at information gathering, following DRY (“don’t repeat yourself”) principles, and maintaining lean operations. This singularity of focus and creative application of technology demonstrated by attackers can be applied to organizations wishing to elevate their security with Zero Trust design principles and identity and visibility-driven analytics. Senior Analyst Tope Olufon will show how thinking like a threat actor can drive your security strategy. Attendees will learn how to:

• Apply reconnaissance techniques to understand their own environment.
• Employ or repurpose generic/existing tools to enhance visibility.
• Jump-start Zero Trust, reduce complexity, and use automation to build resilience.

Speakers:
Tope Olufon, Sr Analyst, Forrester

This session will look at trends of generative AI’s use in fraud management. We will explore the viability of genAI in rule- and machine learning-based model development and management, case routing, case investigation, and reporting. The presentation will also cover risks and best practices of adopting genAI in fraud management. Learn about:

• How fraudsters are using AI to launch attacks.
• Key use cases of genAI in fraud management, anti-money laundering, and know-your-customer.
• Implementation best practices for genAI in fraud.

Speakers:
Andras Cser, VP, Principal Analyst, Forrester

Technology leaders are prioritizing cloud security and increasing their cloud security spend, but that doesn’t mean that cloud security professionals can rest easy. New cloud-based AI offerings, sovereignty regulations and directives, and the increasing pressure of maximizing cloud investments while minimizing carbon footprint all threaten the delicate stasis of securing cloud environments. In this session, you will learn:

• What to expect with cloud-based AI black box models and how to harden for your cloud environment.
• How to address the new sovereignty regulations coming from the EU.
• Different methods to optimize your cloud spend and meet sustainability requirements.

Speakers:
Tracy Woo, Principal Analyst, Forrester

Your single biggest cyber risk is not knowing how much risk you’re exposed to. Cyber risk quantification (CRQ) gives security and risk pros a more accurate, defensible way to assess, communicate, and prioritize the risks that matter most, yet most organizations rely on qualitative methods like risk heat maps and 5×5 ratings that have proven to be useless. It’s time to ditch the subjective heat maps and use CRQ to make risk management easier. Join this session to:

• Understand the value of quantitative risk assessment methods.
• Build the business case for adopting CRQ.
• Plan for your first successful CRQ pilot.

Speakers:
Cody Scott, Senior Analyst, Forrester

The worlds of SecOps and SIEM have fundamentally changed after a series of vendor mergers and acquisitions. What was already complicated by excessive cost, resource constraints, and required expertise has become even more complex and is changing how data storage and management for security operations must be done. Technology choices range from data pipeline management tools to security data lakes, in addition to analytics and automation technologies. Principal Analyst Allie Mellen will discuss data management strategies for SecOps and building a successful data management strategy. Attendees will:

• Learn data management strategies for SecOps in a hybrid, multicloud world.
• Gain understanding of the tools needed for better data management.
• Discover how to evaluate security data management options and make the best architectural decision.

Speakers:
Allie Mellen, Principal Analyst, Forrester

This interactive session will discuss the current state of identity and look ahead to key themes that organizations can expect to see relating to identity in 2025. Topics discussed will include identity threat intelligence, identity threat detection and response, and emerging AI-driven methods used for fraud attacks. Learn:

• How AI is being used to improve identity and access management (IAM) program effectiveness and efficiency.
• The IAM trends that Forrester sees as being poised to dominate 2025.
• The specific identity attack vectors that are emerging.

Speakers:
Merritt Maxim, VP, Research Director, Forrester
Andras Cser, VP, Principal Analyst, Forrester
Geoff Cairns, Principal Analyst, Forrester

CISOs need to stop looking at product security as a siloed part of the security organization. Modern product security programs prioritize customer trust as a fundamental goal as well as securing the product itself. Join us for a presentation and fireside chat with members of Schneider Electric’s product security team. In this session, attendees will hear about:

• The characteristics of an effective product security program.
• How to integrate product security with the rest of the cybersecurity organization and the benefits of doing so.
• How to increase the maturity of the product security function.

Speakers:
Sandy Carielli, Principal Analyst, Forrester

AI and generative AI are revolutionizing business in every department. But without adequate risk management, things will go awry more quickly than you think. Fear not, for brand-new regulations such as the EU AI Act and specific standards are emerging to help companies take care of the risks. Join this session to learn about the AI risk management frameworks and standards that your peers are using and to deep-dive into the new AI rules, including the EU AI Act, to which US and international companies must comply due to their extra-territorial scope. In this session, you will learn about:

• The AI risk frameworks and standards that global companies are adopting.
• The new regulatory requirements of the EU AI Act and to what extent they apply to you.
• Best practices from your peers about their AI compliance and AI risk management efforts.

Speakers:
Enza Iannopollo, Principal Analyst, Forrester

Organizations adopting Zero Trust are now well into their journey, moving past the basic foundational steps and maturing their implementations, but getting to that “next level” of Zero Trust requires even more. This panel discussion, moderated by Forrester Senior Analyst Carlos Rivera, will explore the insights, challenges, and recommendations for maturing Zero Trust by those who have lived it. Attendees will:

• Gain an understanding of common challenges faced with Zero Trust adoption.
• Understand the value of developing outcome-based use cases.
• Learn best practices to mature Zero Trust initiatives from people who are doing it.

Speakers:
Carlos Rivera, Senior Analyst, Forrester

Amidst the rise of cloud, DevOps, internet of things, and generative AI, organizations are contending with an explosion of machine identities (aka nonhuman identities). As organizations increasingly rely on machines for their operational processes, ensuring that these entities are securely authenticated, authorized, and monitored becomes paramount. Session attendees will learn:

• The unique risks and challenges that machine identities present.
• How to establish a unified identity and access management strategy that accounts for machine identities.
• The technologies to apply for automation and resiliency.

Speakers:
Geoff Cairns, Principal Analyst, Forrester

Enterprises are eager to adopt DevSecOps but encounter challenges including securing executive buy-in, unifying siloed teams, selecting the appropriate technology, and understanding the necessary processes to facilitate the transition. In this talk, we will explore a DevSecOps maturity model designed to help leaders navigate these challenges and articulate a vision that encourages buy-in and investment. Session attendees will learn:

• The crawl, walk, run maturity model for DevSecOps.
• How to create a culture where security and development share responsibility and work collaboratively together.
• The processes and technologies to implement as you mature in your DevSecOps journey.

Speakers:
Janet Worthington, Senior Analyst, Forrester

New SEC requirements issued in 2023 made cybersecurity an important part of investor data, with spots reserved for it on 10-Ks and 8-Ks. Unfortunately, plenty of ambiguity still exists on what information should be included, the definition of materiality, and what best practices organizations will follow to provide investors with the right amount of detail. We conducted an analysis of disclosures related to items 1.05 and 106 and will provide a detailed analysis based on over a year’s worth of content for publicly traded companies attempting to comply with the rules. Join this session to:

• Examine how companies are dealing with the ambiguous nature of materiality and its definition in context of cybersecurity.
• Learn the common approaches to cybersecurity governance for publicly traded companies.
• Discover the common security controls and frameworks used by companies based on investor materials.

Speakers:
Jeff Pollard, VP, Principal Analyst, Forrester

Insiders have privileged access to sensitive data and systems, and accidental or malicious data misuse by insiders is a risk to organizations. Data security is the first layer of protection against accidental data loss and data theft. Insider risk management focuses on reducing the risk of accidental and malicious insider incidents. While the functions have differences, they must collaborate to defend data. Principal Analyst Heidi Shey and VP, Research Director Joseph Blankenship will discuss how these functions can work together for a successful data protection strategy. Attendees will learn:

• How data security and insider risk management differ and how they overlap.
• Best practices for protecting sensitive data from insider incidents.
• Recommendations for data security/insider risk management collaboration.

Speakers:
Heidi Shey, Principal Analyst, Forrester
Joseph Blankenship, VP, Research Director, Forrester

Forrester predicts that AI agents will expand over the next couple years. While enterprise use cases dominate today, AI agents will expand and proliferate to consumer use cases and, eventually, consumer-owned AI agents. What does this mean from an identity and fraud perspective? Join this session to learn about:

• The five categories of AI agents.
• The fraud risks that each AI agent category may bring.
• How to prepare for a future of AI agents.

Speakers:
Stephanie Liu, Senior Analyst, Forrester

Application threat modeling gets a bad rap thanks to its misuse as an audit checkbox and unrealistic expectations that a model will find every eventuality. Confusion is abundant about which of the various threat modeling frameworks to use. If you take a fresh look, however, you will see that threat modeling adds another layer of defense and saves dev and security teams time later. It doesn’t require a heavy, overengineered 300-line spreadsheet. In this session, attendees will:

• Dispel common application threat modeling myths.
• Understand how to build a business case for application threat modeling.
• Learn how to discard the old approaches to threat modeling and embrace a new paradigm that meets business, development, and security needs.

Speakers:
Sandy Carielli, Principal Analyst, Forrester

Organizations globally report higher levels of enterprise risk due to their increased reliance on third parties. Combined with the volume of cyberattacks, breaches, and IT disruptions attributed to third parties, businesses recognize that they need more data to determine whether they should partner with a supplier and how to protect themselves during the relationship lifecycle. External cyber risk ratings and security posture signals are becoming an invaluable decoder ring for mitigating third-party cyber risk. Join this session to:

• Understand the relationship between cyber risk ratings and third-party risk management.
• Examine the limitations of cyber risk data in a third-party context.
• Learn the key lifecycle phases and maturity levels for third-party cyber risk management.

Speakers:
Alla Valente, Senior Analyst, Forrester
Cody Scott, Senior Analyst, Forrester

Mobile devices are ubiquitous for users’ personal lives and have become equally as pervasive in their work lives. When surveyed, however, the majority of enterprises don’t employ even the basic level of security on mobile devices that they require on other endpoints such as laptops. This protection gap makes these devices vulnerable and introduces risk into the enterprise. In this session, Senior Analyst Paddy Harrington will discuss why mobile security is a critical part of a security strategy and how enterprises can use Zero Trust and AI to enhance mobile security. Attendees will learn:

• Why mobile devices require advanced protection.
• Recommendations for applying Zero Trust policies to mobile devices.
• How changes in AI can better protect the enterprise through mobile device access.

Speakers:
Paddy Harrington, Senior Analyst, Forrester

Given that so many data breaches relate to authentication issues or theft, organizations are under pressure to enhance existing employee authentication methods. The hardware token or app-centric push notification methods are no longer fool-proof which is why many organizations are actively migration from their existing multi-factor authentication approaches to methods like passwordless that are phishing resistant, improve security without impeding the user experience, Join this session to hear how a well-esteemed customer migrated their entire workforce to passwordless authentication.

Organizations are investing heavily in building API-based microservices architectures and slaying monolithic architectures. Regulation- and API-related security breaches have focused attention on securing APIs, a long-neglected practice. Security leaders are being bombarded with a confusing raft of API security vendors all promising the land of milk and honey if you buy their product. In this session, attendees will:

• Gain a capability framework to use to evaluate API security providers.
• Learn about how the API security market will develop to future-proof your purchases.
• Learn the eight API security practices you need to implement in your organization.

Speakers:
Madelein van der Hout, Senior Analyst, Forrester