Leadership Discussions on Emerging
Cyber, Risk & Fraud Challenges

Registration & Networking

Welcome/Introductions

The Forum is a collaboration point for the many member-driven professional associations across the region. Hear a brief introduction from Board Members of each of those InfoSec & Fraud Associations as we open the agenda

AI Is the New Threat Actor. AI Is the New Defender [Discussion Pod #1]

Cybersecurity in the Machine Age

AI is no longer simply another technology that cybersecurity teams need to secure. It is beginning to change who attacks us, how attacks unfold, how quickly vulnerabilities can be exploited—and how we defend ourselves.

Richard Stiennon, has spent decades mapping the cybersecurity industry. In researching his latest book, Guardians of the Machine Age, he has watched an entirely new AI-security ecosystem emerge at extraordinary speed, with hundreds of companies attacking problems ranging from autonomous security operations and agent security to model protection, identity, vulnerability management, deepfake defense and AI governance. His conclusion: we are not looking at another cybersecurity product cycle. We are watching the structure of the industry change.

But that does not mean ripping out everything that came before.

In this provocative, forward-looking discussion, Richard will separate the durable fundamentals from the genuinely new. What happens when attackers can discover vulnerabilities, develop exploits and persist against a target at machine speed? What changes when defenders can deploy autonomous agents of their own? Which existing security investments become more important—not less? Where is today’s AI-security market producing real innovation, and where are we simply attaching “AI” to familiar products? And what emerging capabilities should security leaders be watching now, before they become mainstream?

Reduce the Probability of Material Impact [Discussion Pod #2]

Using Cybersecurity First Principles to Make Better Risk Decisions

Rick Howard argues that cybersecurity strategy should begin with one irreducible first principle: Reduce the probability of material impact due to a cyber event over a defined period of time.

Cybersecurity leaders are surrounded by frameworks, controls, tools, threat intelligence and an endless stream of urgent priorities. Rick will lead a discussion on using that principle as a practical decision-making filter—not simply as a statement of strategy. Drawing from Cybersecurity First Principles, major cyber incidents and three decades of leadership across military, intelligence, technology and industry, he will challenge several commonly accepted assumptions about how security programs are built and measured.

Participants will explore how to:

• Distinguish meaningful risk reduction from activity that merely creates the appearance of progress
• Connect cybersecurity and fraud decisions to the potential material impact on the organization
• Prioritize limited people, time and budget against the actions most likely to reduce risk
• Use resilience, zero trust, intelligence and risk forecasting as components of one coherent strategy
• Explain cybersecurity priorities to boards and business leaders in language grounded in probability, impact and time

In this talk and the moderated discussion that follows, Rick will leave participants with a practical question they can take back to their organizations: Does this action measurably reduce the probability of material impact—and, if not, why are we doing it?

IAM/reinvited [Discussion Pod #3]

Ravi Khatod has spent decades building and leading cybersecurity companies through successive waves of change. His question for us is deceptively simple: If IAM is a mature market dominated by some of cybersecurity’s biggest companies, why are so many smart people starting new identity companies?

In this fast-paced TED-style talk, Ravi will separate what is genuinely changing from what is simply being renamed. We’ll look at the evolution from human access to non-human identities and now AI agents that can act, transact and make decisions at machine speed—and why that may force us to rethink some very basic assumptions about authentication, authorization, privilege and control.

What does a CISO actually need to understand about NHI? What parts of today's identity architecture will survive the agentic era? What isn't quite here yet—but soon will be? And how much control can we realistically maintain as machines increasingly act on behalf of people and other machines?

Ravi’s goal is to leave leaders with a practical Identity Scorecard: what should already be possible today, where existing approaches are beginning to age out, what deserves a place on the next several years of the roadmap—and the questions CISOs should be asking their teams and vendors now, before agent-centric processes scale faster than their controls.

A moderated discussion will follow to pressure-test that scorecard against the realities in the room—and explore which identity assumptions we may need to unlearn next.

Leading the Fight: Cybersecurity & Government Agencies [Panel]

Executive Panel -

In this talk, government agency leaders will share how they approach coordinated threat disruption, interagency collaboration, and executive-level response to cyber-enabled crimes. 

When cybercrime intersects with national security, terrorism, cross-boarder issues, or financial stability, the US Secret Service, Department of Homeland Security, FBI and state fusion center (NJCCIC) step in—not just with investigations, but with leadership. Drawing from real-world cases—ranging from cryptocurrency scams to insider threats—our panelists will outline lessons learned for private-sector leaders.

What does it take to lead under pressure, across jurisdictions, and in defense of critical assets? In this fast-moving session, participants will get practical takeaways on how to elevate their cyber leadership posture—and why the most effective defenders think like protectors, not just responders.

Panelists: 

• Krista Valenzuela, Bureau Chief - Cyber Threat Outreach & Partnerships - NJ Cybersecurity and Communications Integration Cell (NJCCIC)
• Supervisory Special Agent Michelle Liu, FBI Newark – Cyber Division
• Carlo Nastasi, Special Agent, IRS Criminal Investigation
• Stan Field, Cybersecurity Advisor, CISA Region 2
• Jesse Imbergamo, Supervisory Special Agent, HSI

Biggest Heist Ever: Inside the Hunt for Billions in Stolen Bitcoin [Discussion Pod #4]

What the Bitfinex investigation reveals about the convergence of cybercrime, fraud and financial intelligence

Special Keynote Discussion Leader: Chris Janczewski, Head of Global Investigations, TRM Labs; former IRS-CI Special Agent

Chris Janczewski was the lead investigator at IRS Criminal Investigations, and got a lead he just could not give up.  He went deep on the research… and cracked the “Biggest Heist Ever,” what would eventually be valued at $15 Billion. 

The Netflix documentary Biggest Heist Ever tells the remarkable story of the 2016 Bitfinex hack, an eccentric aspiring rapper known as “Razzlekhan,” and billions of dollars in stolen bitcoin hidden and laundered across the digital economy. Chris Janczewski was the IRS Criminal Investigation special agent who led the landmark investigation—and the man behind much of the story portrayed on screen.

In a focused keynote talk, Chris will take participants inside the investigation, showing how blockchain intelligence, cyber forensics, financial records and traditional investigative techniques were combined to follow the money and recover the stolen assets. He will also explain why the case offers an important lesson for today’s leaders: criminals move seamlessly across the boundaries separating cybercrime, fraud, cryptocurrency, money laundering and traditional finance.

A moderated discussion will follow, exploring what cybersecurity, fraud, AML, risk and compliance leaders can learn from the case—and why closer cooperation between these communities has become an operational imperative.

Lunch & Solution Showcase Networking Discussions

Participants will enjoy a lovely full hot lunch while connecting with the thoughtful Solution Providers who are supporting the community at the Atlantic City CyberSecurity & Fraud Forum

Agentic AI Meets Zero Trust: What Actually Breaks—and How to Fix It [Discussion Pod #5]

Josh Woodruff is the Author of "Agentic AI + Zero Trust," a former CISO, and a long-time advisor in the industry. He will talk more about the years of research that went into the book. 

In the rush to deploy autonomous/semi-autonomous AI, Community Members have shared their doubts that existing identity, data, and control frameworks are ready. Drawing from years of research for his book and field experience, Josh will share:

• Why most agentic AI initiatives fail operationally, not technically
• How Zero Trust principles must evolve for AI agents, workflows, and non-human identities
• Where security teams need to rethink identity, authorization, and monitoring
• What CISOs and CIOs can do now to avoid costly architectural mistakes

This session blends short-form insights with moderated group discussion, focused on immediately actionable takeaways for enterprise leaders.

Whose Definition of "Safe" Is Running in Your Environment? [Discussion Pod #6]

Model Integrity, Inherited Policy, and the New AI Supply Chain

Every open-weight model you deploy arrives with a safety policy already baked into it. Someone decided what that model will refuse to do. That someone worked at a different company, under a different regulator, possibly in a different country, with a different risk appetite and a different definition of acceptable speech than yours. You inherited their judgment the moment you pulled the weights, and you have no practical way to read it, audit it, or prove what it says.

Tim Rohrbaugh, has spent the last year researching model alignment at the weight level and has published roughly 60 modified models. His work shows that refusal and safety behaviors can be surgically altered while the model continues to pass the benchmarks and acceptance tests most organizations rely on. The uncomfortable conclusion: adding a safety behavior and removing one are the same technical operation abet a different cost. Nothing in the artifact distinguishes alignment from tampering, which means your current controls cannot either.

That gap widens across today's AI supply chain. At native precision a model is genuinely inspectable: you can diff the tensors, read the config, and localize exactly what changed. But almost nobody runs models at native precision. You approve a published model and deploy a quantized build produced by a third party you never vetted, through a transformation that buries the signal you would have been looking for. The artifact you can inspect is not the artifact you run, and the handoff between them is currently owned by no one.

Tim will cover what he has actually done and what it means for defenders: open-weight provenance, the AI Bill of Materials as declared provenance, behavioral screening as measured provenance, and practical approaches via modeldna.ai.

You'll leave able to answer, or at least able to ask: If a major model registry like Huggingface hosts a tampered model tomorrow, how long would it take you to determine whether you are running it, including the quantized derivative your vendor shipped or was using?

Degrees, Certs & Entry-Level Grit: What Cyber Grads Can (& Can’t) Do For You
[Panel]

This panel discussion features a real-world exchange between cyber educators and industry leaders. Professors will share how they’re designing programs with hands-on labs, industry-funded projects, and even high school hackathons. CISOs and CTOs will weigh in on the “last-mile” problem: grads with zero experience, mismatched expectations, and a professionalism gap that’s hard to ignore.

With over 700,000 unfilled cybersecurity jobs in the U.S., you’d think the hiring problem would solve itself. But here’s the rub: cybersecurity programs are churning out grads, and CISOs still ask, “What can they actually do on day one?” Are they SOC-ready? Do they understand fraud prevention, governance, compliance—or even what cybersecurity is?

We’ll dig into big questions:

• Are four-year degrees still the gold standard—or are certs and bootcamps the smarter play for mid-career upskilling?
• How do you hire interns and set expectations when “everyone is busy”?
• What can companies do (without breaking budgets) to actually shape the talent pipeline?
• And how can we close the generation gap without lowering the bar?

Come for the honest dialogue, stay for the practical takeaways—and leave with a few ideas for fixing a system that isn’t working for educators, employers, or students.

Panelists:

• Dr. Otto Hernandez,  Vice President - Academic Affairs, Atlantic Cape Community College
• Michael Zambotti, Professor, Saint Francis University
• Sharon Kelley, Executive Director for Information Security & CISO, New Jersey Institute of Technology
• Aakash Taneja, Professor of Computer Information Systems, Stockton University
• Mark Eggleston, CISO, confidential
• Brian Callahan, Director of Cybersecurity Research, Monmouth University 
• Dalal Samaan, CISO, Keenova
• Danny Zakharia, CISO, Children's Hospital of Philadelphia 

The Next Breach Won’t Look Like the Last One: Preparing for What You’re Not Measuring [Discussion Pod #7]

Every security program today is optimized to prevent the last breach.

The controls, dashboards, budgets, and board conversations are all shaped by yesterday’s incidents—ransomware, phishing, endpoint compromise. But the next wave of risk is already forming outside those models: non-human identities, AI-driven decisioning, supply chain entanglement, and silent data manipulation that doesn’t trigger alerts.

In this closing session, we’ll challenge a dangerous assumption: that improving today’s controls will protect you from tomorrow’s threats.

This discussion will explore:

• Why most enterprise security programs are overfit to known attack patterns
• Where visibility is breaking down (AI agents, APIs, third-party logic, machine-to-machine trust)
• How attackers are shifting from disruption to subtle manipulation and persistence
• Why traditional metrics (MTTR, patch SLAs, alert volume) may be giving false confidence
• What leading organizations are doing to rethink detection, trust, and resilience before the next wave hits

This is not a prediction talk. It’s a reality check. Expect a fast-paced, candid discussion that forces a simple but uncomfortable question:  What risks are we blind to—because we’re not even looking for them?

Closing Discussion & Networking

Stay & Connect: Informal Networking + Solution Showcase
Before hitting the road, grab a coffee and take time to connect. Trade insights with peers, chat with Solution Providers, and follow up on the ideas sparked throughout the day.

No panels, no pitches—just real conversations to wrap things up right.