Security & Risk Forum

Minimum Viable Zero Trust

Organizations beginning or advancing Zero Trust initiatives often struggle due to limited budgets, organizational misalignment, and uncertainty about where or how to begin. Achieving Zero Trust does not necessarily require a massive technology investment or organizational overhaul. You can make meaningful progress by adopting a pragmatic, high-impact approach focused on risk reduction while building a foundation for longer-term maturity. This session will explore implementing minimum viable Zero Trust to deliver measurable security improvement through existing investments, operational changes, and governance.

Attendees will learn how to:

Use existing infrastructure as the foundation for a modern Zero Trust architecture.

Conduct a gap analysis to prioritize low-cost, high-impact investments and activities to improve Zero Trust capabilities.

Build realistic roadmaps to continuously improve Zero Trust maturity.

Speakers:
James Plouffe, Principal Analyst, Forrester

Kick Off Your Quantum Security Migration Journey

Quantum security migration will be one of the most significant security transformations your organization undertakes over the next few years, but the constantly changing timelines and evolving regulatory mandates make it difficult to take a breath and determine where to start. This workshop provides a practical framework for building a quantum security migration team, identifying critical dependencies, and managing risk across complex environments. Through guided exercises and discussion, attendees will leave with actionable steps for turning quantum security awareness into a coordinated plan.

Join this workshop to:

Identity your Q-day team.

Prioritize assets and systems for quantum security migration.

Surface third-party risks and develop key questions for your vendors and partners.

Speakers:
Sandy Carielli, VP, Principal Analyst, Forrester

AI Fundamentals

Mythos: Breaking Out of the Vulnerability Matrix

AI-led vulnerability discovery and exploit generation are rapidly reshaping cybersecurity. Capabilities once limited to elite researchers or nation-state actors are now being scaled for both defenders and adversaries, compressing the gap between discovery and weaponization. The implications extend beyond security operations, driving new questions around accountability, governance, and risk. Attendees will learn:

How organizations are adapting to this shift, where AI is outpacing traditional processes, and which new risks and bottlenecks are emerging.

How to identify AI-driven advantages and address asymmetric risks.

How to align roles, metrics, and investments to operate at machine speed.

Speakers:
Erik Nost, Senior Analyst, Forrester
Janet Worthington, Senior Analyst, Forrester

2:40 pm – 3:10 pm EST

Case Study Sessions

3:10 pm – 3:40 pm EST

Forrester Women's Leadership Program: Networking Experience

Session details coming soon.

3:10 pm – 3:40 pm EST

Coffee & Networking Break

Enjoy refreshments and snacks while networking with peers in the Partner Lounge.

3:25 pm – 4:40 pm EST

AI Security Certification (Session Repeat)

Build The Right Foundation To Leverage AI Agents And Agentic Systems In The SOC

The established and emerging use cases of AI agents and agentic systems in security operations
How to structure the security operations function to quickly deploy and get value out of AI agents and agentic systems
How to build the right foundation with data, the right harness, and automation

Speakers:
Allie Mellen, Principal Analyst, Forrester

3:40 pm – 4:40 pm EST

Deep Dives

AEGIS Powers Trusted AI At Scale

Agentic AI is accelerating innovation, but it is also overwhelming leaders with fragmented frameworks, inconsistent guidance, and rising governance demands. The AEGIS framework cuts through this complexity, providing a unified, regulation-aware blueprint to help you govern AI systems and agents with clarity, accountability, and trust. In this hands-on workshop, you will learn how to align your AI governance strategy to core standards while addressing emerging risks from agentic architectures along with regulatory pressure. You will leave with a practical, scalable approach to governing AI that reduces complexity while strengthening trust and control across your organization.

Join this session to:

Simplify AI governance by aligning to a unified framework that maps to major regulatory and risk standards.
Move from fragmented, static policies to continuous, adaptive governance for AI systems and agents.
Prioritize high-impact controls and build a scalable foundation for trusted, compliant AI across the enterprise.

Speakers:
Enza Iannopollo, VP, Principal Analyst, Forrester

Beyond The Human: Evolving Human Risk Management In The Agentic Era

Human risk management has moved security leaders beyond “training as the silver bullet” toward measurable, behavior-driven protection. But in the agentic era, the workforce is no longer exclusively human. AI agents act with increasing autonomy — and if we ignore their behaviors, we create blind spots. This session reframes HRM for a hybrid workforce, exploring how capabilities must evolve to detect cybersecurity behaviors across both people and agents, while keeping accountability firmly human.

What the impact of AI is on your workforce
How AI impacts human related breaches
How human risk management evolves in the agentic era

Speakers:
Madelein van der Hout, Senior Analyst, Forrester

AI Fundamentals

Mythos: Breaking Out of the Vulnerability Matrix (Session Repeat)

How organizations are adapting to this shift, where AI is outpacing traditional processes, and which new risks and bottlenecks are emerging.
How to identify AI-driven advantages and address asymmetric risks.
How to align roles, metrics, and investments to operate at machine speed.

Speakers:
Erik Nost, Senior Analyst, Forrester
Janet Worthington, Senior Analyst, Forrester

4:50 pm – 5:05 pm EST

Welcome Remarks

Forrester CEO, George Colony will kick off the Forum with words of welcome and questions to keep in mind to help you get the most out of your Security & Risk Forum experience.

Speakers:
George Colony, CEO, Forrester

5:05 pm – 5:25 pm EST

Keynote: Trusted Autonomy Starts With Securing Intent

AI compresses decision cycles until controls built for human-paced systems can’t keep up, but autonomous systems won’t break security by ignoring instructions — they’ll break it by following instructions too literally, pursuing the wrong goal too efficiently, or turning helpful behavior into ungoverned power. CISOs now need to govern intent, not just access, data, prompts, or outcomes. This keynote introduces Forrester’s research on securing intent and gives security leaders a new model for classifying agent behavior, proving trust, and controlling autonomy before technically compliant systems create strategically unacceptable risk.

Speakers:
Jeff Pollard, VP, Principal Analyst, Forrester

5:30 pm – 5:50 pm EST

Guest Keynote: More Information To Come

5:50 pm – 6:00 pm EST

What’s Ahead: Making the Most Of Your Forum Experience

Following the opening keynote, our host, VP, Research Director Merritt Maxim, will highlight the key themes shaping the event and provide a roadmap to sessions, discussions, and networking opportunities. Learn how to navigate the agenda, connect with peers, and get the most value from your Forum experience.

Speakers:
Merritt Maxim, VP, Research Director, Forrester

6:00 pm – 7:00 pm EST

Welcome Reception

Join us for an opening night reception full of networking, fun, food and refreshments.

Tuesday Nov 10

8:30 am – 9:30 am EST

General Breakfast

9:30 am – 9:40 am EST

Welcome Remarks

Speakers:
Merritt Maxim, VP, Research Director, Forrester

9:40 am – 10:00 am EST

Keynote: Forge The Trusted Future

AI agents process data, make decisions, take actions, and pursue outcomes autonomously. In this new reality, security is essential but no longer sufficient to build trust. Explainability, accountability, and fairness are indispensable, yet only a governance model embedded in the runtime fabric of AI can deliver them. Too many governance models lack enforcement mechanisms and clear outcomes, making trust an elusive target. The key to success is extending the foundational principles of the AEGIS framework to AI governance models to manage risks beyond security. Join this session to identify who you must collaborate with, which steps you must take, and how to get started redefining AI governance through continuous risk management, least agency, and adaptable controls for the agentic era.

Speakers:
Enza Iannopollo, VP, Principal Analyst, Forrester

10:05 am – 10:25 am EST

Guest Keynote: More Information To Come

10:30 am – 11:00 am EST

Coffee & Networking Break

Enjoy refreshments and snacks while networking with peers in the Partner Lounge.

10:30 am – 11:30 am EST

Workshop: Implementing AEGIS

Agentic AI creates new opportunities and new exposures. Forrester’s AEGIS framework is intended to help organizations safely adopt agentic AI using three core principles and six different domains. This workshop will provide a deeper dive into AEGIS, helping practitioners better understand the framework as well as align it with their existing initiatives, processes, and architectures.

Attend this workshop to:

Understand the three core principles of AEGIS and how they relate to other cybersecurity principles.
Learn about key activities and outcomes related to each of the six AEGIS domains and how to incorporate them into existing processes and architectures.
Learn how the application of AEGIS enables compliance across multiple regulatory regimes.

Speakers:
James Plouffe, Principal Analyst, Forrester

11:00 am – 11:30 am EST

Breakout Sessions

The Rise Of The Trust And Assurance Organization

Generative and agentic AI are rewriting the CISO mandate from protector of systems to provider of trust and assurance. This shift demands a new operating model: restructured teams, new capabilities, and far deeper collaboration across the business. CISOs must also navigate the complexities of integrating agentic AI into their security programs. This session will delve into the transformative potential of agentic AI and its uses, implications, and challenges, helping security leaders:

Learn how AI is changing CISOs’ roles and organizational structures.

Prepare for evolving and merging functions, roles, and responsibilities.

Strengthen stakeholder management skills to align competing priorities across security, IT, legal, and the business.

Speakers:
Jess Burn, Principal Analyst, Forrester

Guardrails For Applications Using AEGIS

As organizations rapidly adopt AI in application architectures, the challenge extends beyond building intelligent systems to effectively governing them. Forrester’s AEGIS framework provides a structured approach to AI-enabled application security, yet many teams struggle to translate its principles into operational guardrails.

In this session, Janet Worthington explores how leading organizations are operationalizing AEGIS to establish robust guardrails throughout the application lifecycle. The focus is on embedding policy, automating enforcement, and creating feedback loops to ensure that AI-enabled applications remain aligned with security, risk, and compliance expectations at scale.

Attendees will learn how to:

Translate AEGIS principles into enforceable guardrails across development, deployment, and runtime environments.

Identify gaps between policy intent and technical implementation that create hidden risk exposure.

Align security, engineering, and governance stakeholders around shared accountability and measurable outcomes.

Speakers:
Janet Worthington, Senior Analyst, Forrester

Agent Vs. Agent: CNAPPs AI-SPM Uses AI Agents To Secure AI Agent Infrastructure

Cloud-native application protection platforms’ AI security posture management (AI-SPM) capabilities are becoming a strategic control point for securing enterprise AI at scale. As organizations adopt AI services, such as the Amazon Bedrock, Microsoft Foundry, and Google Gemini Enterprise platforms, security leaders need stronger visibility into misconfigurations, configuration drift, identity risks, and emerging governance gaps. This session examines the priorities for building an effective AI agent–aided AI-SPM program across people, process, and technology. It will outline how to reduce operational risk, improve regulatory readiness, strengthen oversight of AI environments, and deliver measurable business value through more resilient, compliant, and well-governed AI infrastructure.

Speakers:
Andras Cser, VP, Principal Analyst, Forrester

11:40 am – 12:10 pm EST

Case Study Sessions

12:10 pm – 12:40 pm EST

Breakout Sessions

You Don't Need AI to Defend Against AI

The abstract idea of “AI-powered attacks” is filling a lot of headlines and a lot of marketing copy — and much of the message is how you need AI to defend against AI. Like any threat assessment, practitioners must strike a balance between prioritizing the most likely and the most dangerous. This session will provide a brief overview of the AI-powered attacks observed in the wild, break down their tactics and techniques, and provide insights into how Zero Trust can help mitigate threats or contain potential damage.

Join this session to:

Learn the “what” and “how” of AI-powered attacks in the wild.
Understand how to apply Zero Trust principles to defend against this emerging class of attacks.

Speakers:
Allie Mellen, Principal Analyst, Forrester
James Plouffe, Principal Analyst, Forrester

Contracts: AI Guardrails With Teeth

As AI adoption accelerates, policy alone is not a sufficient control. The real guardrails are contractual — the clauses that define, assign, and legally ensure transparency, accountability, and action across the third-party ecosystem. This session shows how to turn AI principles into enforceable obligations that satisfy regulatory expectations, protect the organization, and make “regulation by contract” a deliberate strategy rather than an accident of paperwork. If it’s not in the contract, it’s not an enforceable guardrail.

Join this session to learn:

Why contracts are the most underutilized tool in the risk tech stack.
Why regulatory ambiguity increases the value of contracts, especially in AI.
How to use contractual terms for AI transparency, accountability, and oversight.

Speakers:
Alla Valente, Principal Analyst, Forrester

IAM For Agentic Architectures: From Least Privilege To Least Agency

AI agents can act, adapt, and make decisions at machine speed, creating risks that traditional identity and access management (IAM) was never designed to address. Securing agentic architectures requires more than controlling access; it requires governing autonomy. This session explores why least privilege is no longer enough and how IAM must evolve for the agentic era.

Attendees will learn how to:

Distinguish least agency from least privilege and understand why both are required for agentic AI security.
Establish a modern identity security foundation for agentic AI.
Apply dynamic authorization, short-lived credentials, and identity risk signals to constrain agent behavior.

Speakers:
Geoff Cairns, Principal Analyst, Forrester

12:10 pm – 1:10 pm EST

Workshop: Advance Your Data Classification Program

Data classification programs often struggle to move from plans and policies to consistent adoption and enforcement. This workshop will help security and risk leaders work through a real, current classification challenge with peers facing similar issues, whether their organization is rebooting a stalled effort or improving an existing program. Through structured small group peer consulting, participants will leave with practical ideas and one specific action to try.

Join this workshop to:

Share and get targeted peer input on a specific data classification problem your organization is facing.
Learn how other organizations are addressing challenges at a stage of program maturity similar to your own.
Identify one practical step you can take in the next two weeks to move your program forward.

Speakers:
Heidi Shey, Principal Analyst, Forrester

12:40 pm – 1:40 pm EST

Networking Lunch

1:40 pm – 1:45 pm EST

Welcome Back

Speakers:
Merritt Maxim, VP, Research Director, Forrester

1:45 pm – 2:05 pm EST

Guest Keynote: More Information To Come

2:10 pm – 2:30 pm EST

Keynote: Identity Context Is King

As agents begin taking autonomous actions, securing agentic identity becomes the foundation for ensuring that every action is trusted, governed, and secure. Access decisions must be driven by rich identity context that combines intent, risk, guardrails, operational realities, and regulatory expectations to guide agent behavior in real time. This keynote explains how to use dynamic identity context to deploy and secure agentic AI architectures at scale.

Speakers:
Andras Cser, VP, Principal Analyst, Forrester

2:45 pm – 3:15 pm EST

Breakout Sessions

Token Economics: Security Budgets In The AI Age

AI won’t make cybersecurity cheaper by default. As agentic AI moves into security operations centers, security platforms, and autonomous workflows, CISOs face a new cost model built on inference tokens, AI credits, premium reasoning models, integration work, and unpredictable consumption. This session shows security leaders how to spot AI cost exposure, govern token consumption, and defend security budgets before overages, throttling, or unfunded agentic workloads create operational risk. Join this session to:

Decode how token pricing, AI credits, and agentic workflows reshape security budgets.
Govern consumption before AI-enabled security tools create the next cloud-cost surprise.
Defend security budgets as AI shifts cost, risk, and accountability across the enterprise.

Speakers:
Jeff Pollard, VP, Principal Analyst, Forrester

Build Resilience For AI

Large-scale AI failures don’t just glitch — they can trigger systemic collapses ranging from unintended cost runs, financial losses, and algorithmic bias scandals to the complete shutdown of critical systems. These major financial and operational disruptions have hit companies such as Zillow, Volkswagen, Air Canada, McDonald’s, and UnitedHealthcare. Don’t let your organization be the next headline.

Join this session to:

Create severe but plausible AI failure scenarios.
Establish best practices to create AI resilience.

Speakers:
Amy DeMartine, VP, Senior Research Director, Forrester

From Human-Led To AI-Driven: The New Reality Of OT Security

The thought of introducing AI-driven automation into operational technology (OT) environments makes security teams cringe. Yet as attacks on business operations rise, AI can mean the difference between staying online and grinding to a halt. This session aims to help you:

Identify the risks from OT security gaps.
Understand where AI delivers value.
Chart a path to adopting AI while maintaining safe, reliable uptime.

Come to learn how AI isn’t replacing operators and analysts but empowering them.

Speakers:
Paddy Harrington, Senior Analyst, Forrester

2:45 pm – 3:45 pm EST

Workshop: Reskilling Cybersecurity Teams For The Agentic Era

Generative and agentic AI are reshaping cybersecurity work and the skills that security teams need to remain effective. This workshop will help CISOs rethink upskilling, career paths, and role design so practitioners can supervise AI-assisted decisions, preserve human judgment, and build trust in security outcomes. Join this workshop to:

Define the cybersecurity skills that matter most in an AI-augmented operating model.

Redesign career paths as AI changes how practitioners build judgment and experience.

Build a reskilling strategy that supports trust, accountability, and resilience.

Speakers:
Jess Burn, Principal Analyst, Forrester

3:15 pm – 4:00 pm EST

Coffee Break & Networking

Enjoy refreshments and snacks while networking with peers in the Partner Lounge.

4:00 pm – 4:30 pm EST

Breakout Sessions

Get Value From Threat Intelligence With Agentic AI

Agentic systems have the potential to be a force multiplier for security teams by amplifying how threat intelligence is operationalized within SecOps. But the reality today is messy — AI agents are inconsistently defined and unevenly implemented, making it difficult to separate substance from marketing noise.

This session cuts through that confusion by bridging agentic AI with modern threat intelligence needs by highlighting high-value use cases (and what makes them high-value), exposing common pitfalls, and outlining how to design a meaningful AI agent. It also dives into testing and validation measures required to keep the outcomes of these systems reliable at scale. And most importantly, it helps security leaders understand how to measure ROI for AI-enabled outcomes. Attendees will gain insights they can use to prepare for the adoption of agentic capabilities, whether they arrive directly or are embedded within existing security solutions.

Speakers:
Jitin Shabadu, Analyst, Forrester

Defending Against Rogue Agents With AEGIS

AI agents are proliferating across enterprises. These agents hold credentials, access sensitive systems, and execute actions without human intervention. They are the new insider threat surface. Detection technology and tactics, however, have not kept pace. This talk breaks down the threat management domain of the AEGIS framework to reduce the risk posed by AI agents of all kinds: those managed by the organization and those not.

Join this session to:

Discover technologies and techniques for monitoring agents, collecting telemetry, and baselining behavior.
Understand how to detect and respond to agentic AI threats as part of the AEGIS framework.

Speakers:
Joseph Blankenship, VP, Research Director, Forrester
Allie Mellen, Principal Analyst, Forrester