Artificial Intelligence continued to dominate the conversation, and content, but the key theme throughout the Gartner Security & Risk Management experience was a little bit more subtle. This year, CISOs from all across the globe came to connect, learn, and explore with peers, vendors, and Gartner, navigating individual and business resilience challenges.

Every AI application runs on APIs. They carry prompts, responses, customer data, and credentials between your models, databases, and third-party services. To secure APIs in AI applications, you need strong authentication, rate limiting, encryption, input validation, and continuous monitoring. But AI adds a layer most API security checklists miss: the data inside the API calls. That data needs protection too.

The Securonix Threat Research team has identified an ongoing espionage campaign, tracked as SHEETCREEP, where threat actors deliver a C# remote access trojan through a diplomatic-themed ISO phishing lure.

Identity tells us an agent is allowed to act, intent tells us why it is acting. In an agentic world, only one of those questions actually predicts whether your environment is about to break.

Data privacy is not just a checkbox for compliance requirements. It has become a core business expectation. Customers now want to know how companies collect, store, process, and protect their data. At the same time, global regulations like the GDPR and CCPA have made privacy a critical part of product development. According to a report by the Cisco Consumer Privacy Survey, 99% of companies saw measurable benefits by investing in privacy.

Picture two realities for the same compliance control reaching production. Reality One: Your AppSec team writes a new rule. An engineer uses Claude Code or Cursor to generate the OPA (Open Policy Agent) Rego policy in minutes. They deploy it. It blocks a legitimate release on a missing context variable, and the on-call engineer routes around the gate to ship the code. The AI gave them fast code — but not code they could trust.

In many organizations, the gap between HR and IT is a "black hole" of productivity and security. When a new hire starts, they often spend their first day staring at a login screen because their access wasn't provisioned. Worse, when an employee leaves, their access to Jira, Slack, or Entra ID might remain active for days or even weeks. This isn’t just an administrative headache; it’s a major security and compliance risk.

Compliance has traditionally lived in dashboards, spreadsheets, screenshots, audit packets, and point-in-time reviews. Security teams know the reality is more dynamic. The evidence auditors need is often buried across identity providers, endpoints, cloud platforms, network controls, vulnerability scanners, alerts, and custom application logs — all generating live operational telemetry that static tools struggle to keep up with.