Topic: Information Security

Seminar Topics

[1 CPE] Identity: The Target and The Weapon

  Presented by Jeffrey Kongswangwongsa, GTM Tech Lead, Identity • Rubrik

Identity infrastructure has quietly become the most critical — and most targeted — attack surface in the enterprise. In this session, we’ll explore why today’s cyberattacks have fundamentally shifted from malware to identity, and what that means for how organizations need to think about protection and recovery.

The session covers the growing threat landscape around Identity Providers (IdPs) like Active Directory, Microsoft Entra ID, and Okta, including why detection is no longer the hard part — removal and recovery are. We’ll dig into real-world case studies, the dangerous “”domino effect”” that happens when identity systems fail during recovery, and how AI is accelerating the speed and scale of identity-based attacks.

Attendees will walk away with a clearer picture of what modern identity resilience looks like: from protecting IdPs with immutable, air-gapped backups to orchestrating clean recovery in hours instead of weeks — without losing legitimate changes or reintroducing attacker persistence.

[1 CPE] Speaking the Language of Risk

  Presented by Tom Ruoff, Principal Consultant • ImageSource

Organizations face rapidly evolving cyber threats, yet many still view technology as a cost center rather than a strategic partner. This presentation reframes the conversation by translating technical risks into business and financial terms leaders understand. Attendees will learn how to identify Business Essential Functions (BEFs), quantify operational and financial impacts, and apply practical risk‑estimation methods. By establishing a common language of risk, leaders can align priorities, invest where it matters most, and meaningfully reduce enterprise exposure. The session equips both executives and IT teams with tools to build consensus and drive smarter, outcome‑based cybersecurity decisions.

Tom Ruoff serves as Principal Consultant for ImageSource, Inc. providing cybersecurity consulting services (risk assessments, threat hunting, pen testing, breach remediation, security architectures, policies, business impact assessment) to commercial clients including Native American Tribes and Tribal Casinos, he is also a founder and current CEO of Zorse Cyber. Tom retired from the Dept of Homeland Security (DHS), Cybersecurity and Infrastructure Security Agency (CISA) in June 2023, as Chief, Methodology Branch, supervising vulnerability assessments for elections, power generation/distribution, and pipelines, and Federal Government IT systems. Before DHS, Tom was the Director of Systems Division at Northrop Grumman, developing cross domain solutions (CDS) for National Security Agency (NSA) and Central Intelligence Agency (CIA). Air Force veteran with tours at NSA, CIA element of the National Geospatial-Intelligence Agency, and Defense Intelligence Agency He is a Level III Federally Certified Program Manager, PMP, CISSP, CMMI Associate, MS/BS degrees in physics and electrical engineering.

[1 CPE] 2026 Global Threat Report: Why Speed, Scale, & Lifecycle Visibility Now Define Cyber Risk

  Presented by Brad Daniels, Systems Engineer • Fortinet

This session explores how cybercrime has evolved into a fully industrialized ecosystem, breaking down the modern threat lifecycle from initial exposure through weaponization, exploitation, and large-scale monetization—often operating at machine speed. Attendees will gain insight into the rise of cloud- and identity-driven attacks, along with practical strategies to increase defensive velocity, disrupt adversaries earlier, and improve visibility across the entire attack lifecycle.

[1 CPE] The Foundation of Strong Security

  Presented by Nick McGillivray, Sr Sales Engineer  • Axonius

Tired of compliance that doesn’t translate into actual risk reduction? This session brings CIS Controls 1 & 2 to life with practical, actionable steps that strengthen your security foundation.

Learn how to improve asset visibility, enforce configuration discipline, and drive measurable security outcomes beyond simply checking compliance boxes. Today’s environments change faster than traditional tools can track —new servers, SaaS apps, AI software, IoT/OT, and NHIs constantly appear, creating blind spots where risk hides.

We’ll cover how to aggregate and correlate data from all your security and IT tools to deliver a single source of truth for your entire attack surface. The result: complete asset intelligence, clear ownership, and the ability to proactively remediate & spot exposures before they become incidents.

[1 CPE] Latest Data Breaches, Quantum Computing, External Key Management in the Cloud

  Presented by Steven Gautier, Principal Solutions Architect • Thales

Welcome to our session on modern data threats and protection strategies. As cyber risks evolve, securing sensitive information is more critical than ever. We’ll explore how encryption and key management can help protect your most valuable assets, especially in cloud environments.

We’ll highlight the benefits of external key management, offering greater control and compliance. Additionally, we’ll touch on the growing impact of quantum computing—and why it’s vital to start preparing now.

Join us to discover the latest advancements in data security and learn how to stay ahead of emerging threats.

[1 CPE] Proving Cyber Resilience: Measuring Outcomes, Not Effort

  Presented by Jake Mickley, Sr Solutions Architect • Horizon3.ai

Most security programs measure effort — not outcomes. Organizations patch thousands of vulnerabilities, deploy dozens of tools, and run annual tabletop exercises… but when an attacker shows up, none of that matters.

What matters is whether they can prove their defenses actually work.

In this talk, Horizon3.ai shares how leading organizations are using autonomous pentesting to see their environment through the attacker’s eyes — continuously, safely, and at scale. By shifting from assumptions to proof, they’ve learned to:

  • Prioritize what’s exploitable. Focus limited resources on the weaknesses that truly put the business at risk that are known to be abused by threat actors.
  • Quickly fix what matters. Close the loop from find → fix → verify and reduce your exploitable attack surface.
  • Reduce attacker dwell time. Use pentest results to precisely deploy honeyTokens to detect compromise early, and to continuously prove your EDR and SIEM are tuned and working as intended.

Cyber resilience isn’t about being perfect — it’s about getting better over time. And the only perspective that truly matters is the attacker’s.

[1 CPE] Data Resilience in the Age of Attack: Protect What Matters

  Presented by Landra Pierce, Product Strategy Technologist • Veeam

Cyberattacks are no longer a distant threat; they are a reality every IT team must be prepared for. When an attack occurs, your data becomes both the primary target and the key to recovery. Many organizations still rely on backup strategies that are designed for hardware failures or accidental deletions, rather than today’s threats, like ransomware, insider risk, and automated attacks. This disconnect creates vulnerabilities, especially when backups become an overlooked entry point in your security strategy. In this session, we will address these challenges to help you better protect your organization.

This session is ideal for IT professionals who want greater confidence in safeguarding their data and peace of mind. We will examine the most common oversights that leave organizations, including those in government, education, healthcare, and other sectors, exposed to cyberthreats. You’ll discover how teams are advancing beyond basic backup to adopt a cyber-ready approach, including topics like immutability, threat awareness, rapid recovery, and intelligent automation.

Our focus will be practical and grounded in real-world scenarios, and what truly works when pressure is high and time is limited. Because when every minute counts and trust is at stake, data resilience means more than surviving an attack. It’s about protecting what matters most and emerging even stronger.

[1 CPE] The AI Mutiny: Regaining Control of the Unauthorized Intelligence Explosion

  Presented by Palo Alto Networks

Your employees are already using AI—the only question is whether you’re invited to the party. Statistics show that nearly 60% of the workforce has bypassed IT to use AI tools, leading to a surge in data exposure and breach incidents. The “Shadow” has returned, and it’s smarter than ever. Join us for a look at the reality of Shadow AI in the enterprise. We’ll analyze real-world breach scenarios and provide a roadmap for reclaiming control. Learn how to empower your workforce with approved, secure AI alternatives that satisfy the need for speed without sacrificing security.

[1 CPE] Cybersecurity and Compliance For 2026

  Presented by Structured

This session examines how organizations can align cybersecurity, privacy, and compliance programs with the realities of 2026. The presentation reviews current threat trends, executive accountability requirements, and the expanding impact of artificial intelligence on risk management. It then connects federal, state, and industry obligations, including NIST CSF 2.0, HIPAA, CJIS, PCI DSS 4.0, CMMC, and emerging privacy laws to practical security program design. Attendees will leave with a clear framework for building a complete security program that integrates governance, segmentation, risk management, Zero Trust principles, and penetration testing to reduce risk and support regulatory readiness.

[1 CPE] From Assessment to Implementation: Inside a Live CMMC Journey

  Presented by Matt Palguta, Cybersecurity Director • Bering Straits Native Corporation

The Department of War’s CMMC program has lifted off for Stage One. This session will feature updates on the program from a CMMC Lead Assessor who will be wrapping up his own program assessment just before the conference with Bering Straits. Listen in on lessons learned from assessing and guiding other organizations while building a CMMC program. The final rule brought clarity and some new wrinkles. Not all of your OS crypto modules have yet to pass FIPS Validation… Hmm, is that an Enduring Exception or an Operational Plan of Action? What are those? There will be time for questions at the end, and Matt will be available to answer additional questions after the session as well.

Matt Palguta has 20+ years of cybersecurity experience in government contracting and manufacturing. As Cybersecurity Director for Bering Straits Native Corporation, he has built their CMMC compliance program to be certified and support future compliance needs beyond CUI data. Matt’s experience includes building a security operations center for the FAA and managing global cybersecurity operations for Cummins Diesel. He teaches as an adjunct professor of cybersecurity with Ivy Tech. Matt is also the founder and CEO of Alyeska Cybersecurity LLC, a CMMC and industrial control system consultancy.