Security & Risk Forum

The Rise Of The Trust And Assurance Organization

Generative and agentic AI are rewriting the CISO mandate from protector of systems to provider of trust and assurance. This shift demands a new operating model: restructured teams, new capabilities, and far deeper collaboration across the business. CISOs must also navigate the complexities of integrating agentic AI into their security programs. This session will delve into the transformative potential of agentic AI and its uses, implications, and challenges, helping security leaders:

Learn how AI is changing CISOs’ roles and organizational structures.

Prepare for evolving and merging functions, roles, and responsibilities.

Strengthen stakeholder management skills to align competing priorities across security, IT, legal, and the business.

Speakers:
Jess Burn, Principal Analyst, Forrester

Guardrails For Applications Using AEGIS

As organizations rapidly adopt AI in application architectures, the challenge extends beyond building intelligent systems to effectively governing them. Forrester’s AEGIS framework provides a structured approach to AI-enabled application security, yet many teams struggle to translate its principles into operational guardrails.

In this session, Janet Worthington explores how leading organizations are operationalizing AEGIS to establish robust guardrails throughout the application lifecycle. The focus is on embedding policy, automating enforcement, and creating feedback loops to ensure that AI-enabled applications remain aligned with security, risk, and compliance expectations at scale.

Attendees will learn how to:

Translate AEGIS principles into enforceable guardrails across development, deployment, and runtime environments.

Identify gaps between policy intent and technical implementation that create hidden risk exposure.

Align security, engineering, and governance stakeholders around shared accountability and measurable outcomes.

Speakers:
Janet Worthington, Senior Analyst, Forrester

Agent Vs. Agent: CNAPPs AI-SPM Uses AI Agents To Secure AI Agent Infrastructure

Cloud-native application protection platforms’ AI security posture management (AI-SPM) capabilities are becoming a strategic control point for securing enterprise AI at scale. As organizations adopt AI services, such as the Amazon Bedrock, Microsoft Foundry, and Google Gemini Enterprise platforms, security leaders need stronger visibility into misconfigurations, configuration drift, identity risks, and emerging governance gaps. This session examines the priorities for building an effective AI agent–aided AI-SPM program across people, process, and technology. It will outline how to reduce operational risk, improve regulatory readiness, strengthen oversight of AI environments, and deliver measurable business value through more resilient, compliant, and well-governed AI infrastructure.

Speakers:
Andras Cser, VP, Principal Analyst, Forrester

11:40 am – 12:10 pm EST

Case Study Sessions

12:10 pm – 12:40 pm EST

Breakout Sessions

Defend Against AI Attacks With Zero Trust

The abstract idea of “AI-powered attacks” is filling a lot of headlines and a lot of marketing copy. Like any threat assessment, practitioners must strike a balance between prioritizing the most likely and the most dangerous. This session will provide a brief overview of the AI-powered attacks observed in the wild, break down their tactics and techniques, and provide insights into how Zero Trust can help mitigate threats or contain potential damage.

Join this session to:

Learn the “what” and “how” of AI-powered attacks in the wild.

Understand how to apply Zero Trust principles to defend against this emerging class of attacks.

Speakers:
Allie Mellen, Principal Analyst, Forrester
James Plouffe, Principal Analyst, Forrester

Build Resilience For AI

Large-scale AI failures don’t just glitch — they can trigger systemic collapses ranging from unintended cost runs, financial losses, and algorithmic bias scandals to the complete shutdown of critical systems. These major financial and operational disruptions have hit companies such as Zillow, Volkswagen, Air Canada, McDonald’s, and UnitedHealthcare. Don’t let your organization be the next headline.

Join this session to:

Create severe but plausible AI failure scenarios.

Establish best practices to create AI resilience.

Speakers:
Amy DeMartine, VP, Senior Research Director, Forrester

IAM For Agentic Architectures: From Least Privilege To Least Agency

AI agents can act, adapt, and make decisions at machine speed, creating risks that traditional identity and access management (IAM) was never designed to address. Securing agentic architectures requires more than controlling access; it requires governing autonomy. This session explores why least privilege is no longer enough and how IAM must evolve for the agentic era.

Attendees will learn how to:

Distinguish least agency from least privilege and understand why both are required for agentic AI security.

Establish a modern identity security foundation for agentic AI.

Apply dynamic authorization, short-lived credentials, and identity risk signals to constrain agent behavior.

Speakers:
Geoff Cairns, Principal Analyst, Forrester

12:10 pm – 1:10 pm EST

Workshop: AEGIS Powers Trusted AI At Scale

Agentic AI is accelerating innovation, but it is also overwhelming leaders with fragmented frameworks, inconsistent guidance, and rising governance demands. The AEGIS framework cuts through this complexity, providing a unified, regulation-aware blueprint to help you govern AI systems and agents with clarity, accountability, and trust. In this hands-on workshop, you will learn how to align your AI governance strategy to core standards while addressing emerging risks from agentic architectures along with regulatory pressure. You will leave with a practical, scalable approach to governing AI that reduces complexity while strengthening trust and control across your organization.

Join this session to:

Simplify AI governance by aligning to a unified framework that maps to major regulatory and risk standards.

Move from fragmented, static policies to continuous, adaptive governance for AI systems and agents.

Prioritize high-impact controls and build a scalable foundation for trusted, compliant AI across the enterprise.

Speakers:
Enza Iannopollo, VP, Principal Analyst, Forrester

12:40 pm – 1:40 pm EST

Networking Lunch

1:40 pm – 1:45 pm EST

Welcome Back

Speakers:
Merritt Maxim, VP, Research Director, Forrester

1:45 pm – 2:05 pm EST

Guest Keynote: More Information To Come

2:10 pm – 2:30 pm EST

Keynote: Forge The Trusted Future

AI agents process data, make decisions, take actions, and pursue outcomes autonomously. In this new reality, security is essential but no longer sufficient to build trust. Explainability, accountability, and fairness are indispensable, yet only a governance model embedded in the runtime fabric of AI can deliver them. Too many governance models lack enforcement mechanisms and clear outcomes, making trust an elusive target. The key to success is extending the foundational principles of the AEGIS framework to AI governance models to manage risks beyond security. Join this session to identify who you must collaborate with, which steps you must take, and how to get started redefining AI governance through continuous risk management, least agency, and adaptable controls for the agentic era.

Speakers:
Enza Iannopollo, VP, Principal Analyst, Forrester

2:30 pm – 2:35 pm EST

Host Remarks

Speakers:
Merritt Maxim, VP, Research Director, Forrester

2:45 pm – 3:15 pm EST

Breakout Sessions

Token Economics: Security Budgets In The AI Age

AI won’t make cybersecurity cheaper by default. As agentic AI moves into security operations centers, security platforms, and autonomous workflows, CISOs face a new cost model built on inference tokens, AI credits, premium reasoning models, integration work, and unpredictable consumption. This session shows security leaders how to spot AI cost exposure, govern token consumption, and defend security budgets before overages, throttling, or unfunded agentic workloads create operational risk. Join this session to:

Decode how token pricing, AI credits, and agentic workflows reshape security budgets.

Govern consumption before AI-enabled security tools create the next cloud-cost surprise.

Defend security budgets as AI shifts cost, risk, and accountability across the enterprise.

Speakers:
Jeff Pollard, VP, Principal Analyst, Forrester

Contracts: AI Guardrails With Teeth

As AI adoption accelerates, policy alone is not a sufficient control. The real guardrails are contractual — the clauses that define, assign, and legally ensure transparency, accountability, and action across the third-party ecosystem. This session shows how to turn AI principles into enforceable obligations that satisfy regulatory expectations, protect the organization, and make “regulation by contract” a deliberate strategy rather than an accident of paperwork. If it’s not in the contract, it’s not an enforceable guardrail.

Join this session to learn:

Why contracts are the most underutilized tool in the risk tech stack.

Why regulatory ambiguity increases the value of contracts, especially in AI.

How to use contractual terms for AI transparency, accountability, and oversight.

Speakers:
Alla Valente, Principal Analyst, Forrester

From Human-Led To AI-Driven: The New Reality Of OT Security

The thought of introducing AI-driven automation into operational technology (OT) environments makes security teams cringe. Yet as attacks on business operations rise, AI can mean the difference between staying online and grinding to a halt. This session aims to help you:

Identify the risks from OT security gaps.

Understand where AI delivers value.

Chart a path to adopting AI while maintaining safe, reliable uptime.

Come to learn how AI isn’t replacing operators and analysts but empowering them.

Speakers:
Paddy Harrington, Senior Analyst, Forrester

2:50 pm – 3:50 pm EST

Workshop: Zero Trust For Public Sector

Federal, state, and local government agencies continue to face mounting pressures to modernize cybersecurity programs while meeting evolving mandates, budget constraints, and operational demands. Zero Trust is now the foundational strategic framework for protecting critical systems, sensitive data, and public services, but many organizations struggle to translate policy into practical application of Zero Trust that aligns it to existing security investments, mission priorities, regulatory requirements, and measurable risk reduction.

Attendees will learn how to:

Align Zero Trust initiatives with federal mandates, compliance requirements, and agency missions.

Prioritize security capabilities around high-risk, high-impact areas to improve resilience without requiring wholesale technology replacements.

Build out milestones for deliverables around identity, devices, networks, applications, and data.

Speakers:
Carlos Rivera, Senior Analyst, Forrester

3:15 pm – 4:00 pm EST

Coffee Break & Networking

Enjoy refreshments and snacks while networking with peers in the Partner Lounge.

4:00 pm – 4:30 pm EST

Breakout Sessions

Get Value From Threat Intelligence With Agentic AI

Agentic systems have the potential to be a force multiplier for security teams by amplifying how threat intelligence is operationalized within SecOps. But the reality today is messy — AI agents are inconsistently defined and unevenly implemented, making it difficult to separate substance from marketing noise.

This session cuts through that confusion by bridging agentic AI with modern threat intelligence needs by highlighting high-value use cases (and what makes them high-value), exposing common pitfalls, and outlining how to design a meaningful AI agent. It also dives into testing and validation measures required to keep the outcomes of these systems reliable at scale. And most importantly, it helps security leaders understand how to measure ROI for AI-enabled outcomes. Attendees will gain insights they can use to prepare for the adoption of agentic capabilities, whether they arrive directly or are embedded within existing security solutions.

Speakers:
Jitin Shabadu, Analyst, Forrester

Defending Against Rogue Agents With AEGIS

AI agents are proliferating across enterprises. These agents hold credentials, access sensitive systems, and execute actions without human intervention. They are the new insider threat surface. Detection technology and tactics, however, have not kept pace. This talk breaks down the threat management domain of the AEGIS framework to reduce the risk posed by AI agents of all kinds: those managed by the organization and those not.

Join this session to:

Discover technologies and techniques for monitoring agents, collecting telemetry, and baselining behavior.

Understand how to detect and respond to agentic AI threats as part of the AEGIS framework.

Speakers:
Joseph Blankenship, VP, Research Director, Forrester