Register Now
August 3-8, 2024
Mandalay Bay / Las Vegas

CISO Summit at Black Hat USA

Tuesday, August 6, 2024

Four Seasons, Las Vegas, NV

Four Seasons Ballroom, Level 2


Overview

The Black Hat CISO Summit is an approval-only event during Black Hat USA which brings together top security executives from global corporations and government agencies for a full day of unique discussions. Offered the day before the main Black Hat USA Briefings sessions, the CISO Summit is intended to give CISOs and other InfoSec executives leading-edge insight into the latest security trends, technologies, and enterprise best practices.


Next Round of Applications will be Reviewed on July 1

Apply to attend

The cost to attend includes Business Hall Access during Black Hat USA on Aug 7 and 8.

Due to limited space, Black Hat Management will review all applications. Notification of application status will be sent within 30 days of application.

*Please note: In order to create an open and candid environment that promotes the sharing of ideas and discussion, the CISO Summit will follow Chatham House Rule; neither media nor event coverage is permitted. This program was designed for executive security practitioners; solution providers and vendor attendees are limited to event sponsors.


Agenda

Monday, August 5

5:00 - 7:00 PM CISO Summit Welcome Reception

Tuesday, August 6

8:00 - 9:00 AM Networking Breakfast
9:00 – 9:20 AM Welcome and Introductions
  • Jeff Moss, Founder, Black Hat + DEF CON

    Mr. Moss advises companies on security issues, both, electronic and physical, as well as speaking globally on the topic. He sits on several advisory boards helping enterprises make informed decisions on cyber risks.

    In April 2011 Mr. Moss was appointed as the Chief Security Officer for the Internet Corporation for Assigned Names and Numbers (ICANN), a non-profit whose responsibilities include coordinating and ensuring the security, stability and resiliency of the Internet's unique global identifiers as well as maintaining the root zone of the Internet. This position involved managing the IT security of the ICANN networks and information systems, the physical security of ICANN facilities and meetings, and ensuring that ICANN meets its security and resiliency commitments to the multi stake holder community that oversees ICANN. This position involved extensive international travel and coordination with governments, law enforcement, and operational security communities in support of discussions around Internet Governance and security. Mr. Moss left this position at the end of 2013.

    Moss is the founder and creator of both the Black Hat Briefings and DEF CON, two of the most influential information security conferences in the world, attracting over ten thousand people from around the world to learn the latest in security technology from those researchers who create it. DEF CON just had its 21st anniversary.

    Prior to creating Black Hat Briefings, Jeff was a director at Secure Computing Corporation where he helped establish their Professional Services Department in the United States, Asia, and Australia. His primary work was security assessments of large multi-national corporations. Jeff has also worked for Ernst & Young, LLP in their Information System Security division. Because of this unique background Jeff is uniquely qualified with his ability to bridge the gap between the underground researcher community and law enforcement, between the worlds of pure research and the responsible application of disclosure.

    Jeff is currently a member of the U.S. Department of Homeland Security Advisory Council (HSAC), providing advice and recommendations to the Secretary of the Department of Homeland Security on matters related to homeland security. Jeff is a life member of the Council on Foreign Relations, which is an independent, nonpartisan membership organization, think tank, and publisher.

    In 2013, Jeff was appointed as a Nonresident Senior Fellow at the Atlantic Council, associated with the Cyber Statecraft Initiative, within the Brent Scowcroft Center on International Security.

    In 2014, Jeff joined the Georgetown University School of Law School Cybersecurity Advisory Committee.

    Jeff is active in the World Economic Forum, and recently became a member of the Cyber Security Global Agenda Council for 2014-2016.

    ICSA President's Award for Public Service, 2011.


  • Steve Wylie, General Manager, Black Hat

9:20 – 9:50 AM Quantifying the Cost of Cyber Risk
  • Scott Stransky

    Scott Stransky is Managing Director and Head of the Marsh McLennan Cyber Risk Intelligence Center. The Center launched in 2021 to provide cyber modeling, thought leadership, and cyber analytics guidance across Marsh McLennan. Previously, he led the Cyber Modeling group at extreme event modeling firm AIR Worldwide (part of Verisk Analytics). Under his leadership and guidance, the team sourced and cleansed detailed cyber security, incident, and claims data, and combined it with advanced machine learning algorithms, stochastic modeling techniques, and Monte Carlo simulations, providing the insurance industry with a robust suite of models to manage their cyber insurance portfolios. He is a recognized speaker across North America and Europe on the topics of cyber insurance risk and catastrophe modeling, having been invited to speak at numerous conferences sponsored by Advisen, NetDiligence, IUA of London, RAA, CPCU Society, AM Best, Lloyd's, and others, in addition to engaging directly with clients. He was voted by his industry peers to be the 2023 Cyber Risk Industry Person of the Year in the Actuary/Modeler category. Mr. Stransky earned a bachelor’s degree in Mathematics with Computer Science from MIT and a master’s degree in Atmospheric Science from MIT.


9:50 – 10:20 AM Engineering and Security Working Together
10:20 - 10:40 AM Break
10:40 – 11:10 AM Lightning Talks: Briefings Session Summaries
11:10 – 11:40 AM Optimizing Supply Chain Management
  • Beth-Anne Bygum, Chief Information Security Officer, Q2

    Cybersecurity issues and the potential to disrupt resilient operations and brand trust is top priority for publicly traded companies and corporate boards. Risks, particularly cyber risks are accelerating and if not prepared, can undermine regulatory compliance, strategic growth and worse, weaken consumer loyalty. Navigating this environment, proactively responding to changes in regulatory expectations and managing fluctuating residual concerns requires knowledge and an understanding of proactive planning.

    At Q2, Beth-Anne is responsible for the company’s global information protection, product & application security (SSDLC), enterprise IT security, cyber defense, and data protection strategy and services. Our security program is designed to scale with changes across the digital and development landscape while enabling the organization to achieve growth and revenue targets. Beth-Anne is a member of Q2’s senior leadership team reporting to the president.

    With more than 30 years of experience directing disparate teams across application and product security, cyber security, risk management, information governance, IT compliance, IT training and sales, Beth-Anne has a proven expertise in connecting teams, people and leaders across the organization in solving operational challenges that require large scale transformation.

    Beth-Anne holds a Master of Science degree in management and leadership (MSLM) from the University of La Verne and a bachelor’s degree in business administration from Rutgers University. She has worked with leading companies in data science, technology, consumer packaged goods, biotechnology, pharmaceutical and consulting sectors. Beth-Anne holds a Certified Business Continuity Professional (CBCP) designation and is a member of NTSC, National Technology Security Coalition, a non-profit, non-partisan organization that serves as the preeminent advocacy voice for CISOs working with public and private sector stakeholders. Her work there is to help advance policies that improve national cybersecurity standards and awareness.

    Beth-Anne is a board advisor to non-profit, the Forge Institute, she and her husband volunteer their time to assist resources in underserved communities as well as transitioning military members into the civilian workforce.


  • Peter Naumovski, CISO, Abbie
11:40 AM – 12:20 PM AI Unleashed: Managing the Risks, Reaping the Rewards

Panel

  • Russ Bodnyk, Principal Scientist, NuLabs.ai
  • Kristy Hornland, Director, KPMG

    Kristy Hornland is a Director at KPMG US specializing in AI security. She has delivered responsible and secure AI governance programs for leading life sciences, financial services, and government clients aligned to industry leading frameworks and practices, deployed AI security platforms to support these program objectives, and also has held the position of Global Resilience Federation AI Security Working Group facilitator for the last two years. She has been deeply integrated in emerging technologies throughout her ten year career with KPMG, and was part of the core team incubating KPMG’s first start up, Cranium, an AI Security platform. She is also the Women in Cyber deputy lead for KPMG US, defining the annual strategy and supporting overall governance to enable the entry, ongoing success, and long term retention of women at KPMG.


  • Jason Clinton
  • Matt Knight
  • Google
12:20 - 1:40 PM Lunch
1:40 – 2:10 PM Deepfakes
  • John Whaley
2:10 – 2:40 PM Surviving and Thriving After the Breach: A Resilience Roadmap
  • Christopher Hoff, Chief Secure Technology Officer, LastPass

    Christofer Hoff joined LastPass as Chief Secure Technology Officer in 2022, leading software and platform engineering as well as enterprise and platform security teams. Hoff brings 30 years of experience in high-profile global roles in network, application and information security architecture, software development, engineering, operations, and management.

    Before joining LastPass, Christofer had multiple cyber security engineering and operations leadership roles at Bank of America. His previous roles include Chief Information Security Officer at Citadel, Vice President and Security CTO at Juniper Networks, and Director of Cloud & Virtualization Solutions at Cisco Systems, among other security-focused roles.

    In addition to his professional leadership responsibilities, Chris takes an active role in engaging youth in the impact of technology, privacy and security on society and culture as founder of HacKid, an interactive STEAM conference for parents and kids from diverse backgrounds. Chris was a founding member of and technical advisor to the Cloud Security Alliance and serves as an advisor to numerous companies and organizations.


  • TBA
2:40 – 3:00 PM Break
3:00 – 3:40 PM Navigating the Regulatory Landscape: A Fireside Chat on SEC Actions and Corporate Responses
  • Jennifer Lee, Partner, Jenner & Block

    Jennifer Lee is a former Assistant Director in the US Securities and Exchange Commission’s (SEC) Division of Enforcement, Jen represents public and pre-IPO companies, corporate officers, financial institutions, and asset management firms in high-stakes regulatory investigations, internal investigations, and litigation. During her twelve year-career at the SEC, Jennifer supervised attorneys and accountants in a broad range of complex investigations and enforcement actions, and has specialized expertise in cybersecurity, financial reporting and internal controls, and ESG. Jen brings nearly twenty years of experience as a litigator in the government and the private sector to help clients navigate government scrutiny. As a highly regarded expert on the SEC’s enforcement program and federal securities laws, Jen is a frequent speaker at industry events, including Securities Enforcement Forum West and the Bar Association of San Francisco.


  • Chenxi Wang, Managing General Partner, Rain Capital

    Chenxi Wang is an experienced technology executive with deep cybersecurity expertise. Board of Director for MDU Resources, a Fortune 500 company, serving on Audit and ESG Committee. Founder and General Partner of Rain Capital, a Cyber-focused venture fund. Chenxi has held senior tech strategy roles in large companies (Intel Security). She has led Go-to-market operations and product strategy in booming Silicon Valley startups (Twistlock, Ciphercloud). Chenxi is also an advocate for diversity & inclusion, and founder of the Forte Group, a 5013(C) organization to advance women's careers in Cyber. Previously Chenxi was a computer engineering professor at Carnegie Mellon University. She holds a Ph.D. in Computer Science.


3:40 – 4:10 PM From the Server Room to the Boardroom: Insights from a Journey Beyond the CISO Role
  • Joanna Burkey, Founder, Flat Rock Strategic Advisors

    Joanna Burkey is a corporate director, former cybersecurity executive and the founder of Flat Rock Strategic Advisors. She serves on the boards of Beyond Inc (NYSE: BYON) and ReliabilityFirst Corporation and also provides advisory and consulting services to multiple enterprises. Her three-decade career in cybersecurity and technology spanned engineering, strategy, and digital transformation, most recently as the CISO for HP Inc. She holds NACD Directorship Certification from the National Association of Corporate Directors, is a certified Qualified Technology Expert with the Digital Directors Network, and was previously a fellow with the Center for Strategic and International Studies in Washington DC. She is based in Austin, Texas.


4:10 – 4:45 PM Government Update
  • Jen Easterly, Director, Cybersecurity and Infrastructure Security Agency (CISA)

    Jen Easterly is the Director of the Cybersecurity and Infrastructure Security Agency (CISA). She was nominated by President Biden in April 2021 and unanimously confirmed by the Senate on July 12, 2021. Before coming to CISA, Jen was Head of Firm Resilience at Morgan Stanley. A two-time recipient of the Bronze Star, Jen retired from the U.S. Army after more than 20 years, including deployments in Haiti, the Balkans, Iraq, and Afghanistan. Responsible for standing up the Army’s first cyber battalion, she was also instrumental in the creation of United States Cyber Command. A graduate of West Point, Jen holds a master’s degree from the University of Oxford, where she studied as a Rhodes Scholar. She is the recipient of numerous honors, including the George C. Marshall Award in Ethical Leadership and the National Defense University Admiral Grace Hopper Award. She is a proud Mom, a mental health advocate, a Rubik’s Cube enthusiast, and an aspiring electric guitarist.


4:45 - 5:00 PM Closing Remarks

Advisory Board

Justine Bone
Trey Ford
Jeremiah Grossman
Robert Hansen
Allison Miller
Wendy Nather
Caleb Sima
Alex Stamos
Saša Zdjelar

Sponsors

Welcome Reception Sponsor

Customers trust the Absolute Cyber Resilience Platform to ensure their security solutions work as intended, mobile and hybrid workforces can connect securely from anywhere, and to quickly restore business continuity following cyber disruptions and attacks. Absolute is partnered with 28 of the world’s leading endpoint device manufacturers, embedded in the firmware of 600 million devices, trusted by 21,000 global enterprises, and licensed across 16 million PC users. Our patented solution is recognized for extending cyber resilience across multiple security categories, including Endpoint Security, Zero Trust Network Access (ZTNA), Security Services Edge (SSE), Automated Security Control Assessment (ASCA), and Zero Trust Platforms.


Premium Sponsors

Armis, the asset intelligence cybersecurity company, secures Fortune 100, 200 and 500 companies as well as national governments, state and local entities to help keep critical infrastructure, economies and society stay safe and secure 24/7. Armis is a privately held company headquartered in California.

Yevgeny Dibrov
Nadir Izrael
Curtis Simpson

Gurucul is a security analytics company founded in data science that delivers radical clarity about cyber risk. Our platform analyzes enterprise data at scale using machine learning and artificial intelligence. Instead of alerts, you get real-time, actionable information about true threats and their associated risk. The platform is open, flexible and cloud native. It conforms to your business requirements, so you don't have to compromise. Our solutions are used by Global 1000 enterprises and government agencies to minimize their cybersecurity risk. To learn more, visit gurucul.com and follow us on LinkedIn and Twitter.

Saryu Nayyar
Craig Cooper

Qualys is a pioneer and leading provider of cloud-based security and compliance solutions that help organizations streamline and consolidate their security and compliance solutions and build security into digital transformation. The Qualys Cloud Platform and its integrated Cloud Apps deliver businesses critical security intelligence continuously across global IT assets.

Sumedh Thakar
Pinkesh Shah
Jonathan Trull

Foundation Sponsors

Discover the transformative power of ultra-fast, dependable fiber and 5G connectivity, all safeguarded by robust, integrated security measures. At AT&T Business we offer an unparalleled boost to your network's potential through the Next Level Network and Dynamic Defense - our new network embedded security product. Our team of experts are ready to collaborate with you to tackle your unique challenges and fast-track your success. Experience the distinct advantage of AT&T Business’s converged network with LevelBlue's managed security services to learn how organizations can seamlessly blend security with innovation.


Bitdefender provides cybersecurity solutions with leading security efficacy, performance, & ease of use to enterprise organizations & consumers. The company is committed to defending organizations & individuals around the globe against cyberattacks.

For more information, visit www.bitdefender.com.


CrowdStrike, a global cybersecurity leader, has redefined modern security with the world's most advanced cloud-native platform for protecting critical areas of enterprise. The CrowdStrike Falcon platform delivers rapid and scalable deployment, superior protection and performance, reduced complexity and immediate time-to value. CrowdStrike: We stop breaches.

George Kurtz
Michael Sentonas

ReliaQuest is the force multiplier of security operations. Our security operations platform, GreyMatter, automates detection, investigation and response across cloud, endpoint, and on-premises tools and applications. GreyMatter is cloud native, built on an open XDR architecture and delivered as a service any time of the day, anywhere in the world. With over 800 customers worldwide and 1,200+ teammates working across six global operating centers, ReliaQuest is driving outcomes for the most trusted enterprise brands in the world. We exist to make security possible. For more information visit www.reliaquest.com.

Col. John Burger (Ret.)
Rick Holland

Securonix revolutionizes cyber operations with precise, rapid and efficient threat detection, investigation and response. Its unified platform streamlines operations, employs advanced AI and analytics for accuracy, supports multi-cloud environments and seamlessly enhances existing detection systems. Securonix significantly reduces cyber risks and improves operational efficiency with a frictionless experience for the security team.

Nayaki Nayyar
Haggai Polak

Sophos delivers superior cybersecurity outcomes by providing cybersecurity as a service to protect companies of all sizes from the most advanced cyberthreats. Our cybersecurity products and services include managed detection and response (MDR), firewall, email, endpoint (XDR), and cloud native security protection. Sophos products and services defend against ransomware, phishing, malware, and more. They connect through the cloud-based Sophos Central management console and are powered by Sophos X-Ops, our cross-domain threat intelligence unit. We provide fully managed security solutions so you can manage your cybersecurity directly with our security operations platform. Or, you can supplement your in-house team with Sophos' products and services.

www.sophos.com

Joe Levy
Ross McKerchar

Breakfast Sponsors

Check Point is a leading provider of cyber security solutions globally, protecting customers from 5th generation attacks with an industry leading catch rate of malware, ransomware and other types of attacks. We offer multilevel security architecture, “Infinity” Total Protection with Gen V advanced threat prevention, which defends enterprises’ cloud, network and mobile device held information. www.checkpoint.com


HackerOne is the global leader in human-powered security. We leverage human ingenuity to pinpoint the most critical security flaws across your attack surface to outmatch cybercriminals. The HackerOne’s Platform combines creative human intelligence with the latest artificial intelligence to help organizations reduce risk and transform their businesses with confidence..


Strengthen digital resilience by modernizing your SOC with unified threat detection, investigation and response. Splunk delivers a scalable security analytics platform with out-of-the-box detections, risk-based alerting, automation and machine learning to help you reduce business risk, empower security innovation and establish efficient and effective SecOps at scale.


Networking Break Sponsors

Devo replaces traditional SIEMs with a real-time security data platform.
Devo’s integrated platform serves as the foundation of your security operations and includes data-powered SIEM, SOAR, and UEBA. AI and intelligent automation help your SOC work faster and smarter so you can make the right decisions in real-time.


ExtraHop is the cybersecurity partner enterprises trust to reveal cyber risk and build business resilience. The ExtraHop RevealX network detection and response platform uniquely delivers the unparalleled visibility and decryption capabilities that organizations need to investigate smarter, stop threats faster, and move at the speed of risk.


Sponsored Executive Dinner - Monday, Aug. 5

ServiceNow makes the world work better for everyone. Our cloud-based platform, risk, ESG, and security solutions help digitize and unify organizations so that they can find smarter, faster, better ways to address evolving risks, vulnerabilities, and compliance challenges. Bring risk, security, and IT together through a common data model to drive risk-informed decisions, unlock productivity, and build trust with customers, employees, and third parties. The world works with ServiceNowTM.

www.servicenow.com/securityandrisk


Sponsored Executive Dinner - Tuesday, Aug. 6

Discover the transformative power of ultra-fast, dependable fiber and 5G connectivity, all safeguarded by robust, integrated security measures. At AT&T Business we offer an unparalleled boost to your network's potential through the Next Level Network and Dynamic Defense - our new network embedded security product. Our team of experts are ready to collaborate with you to tackle your unique challenges and fast-track your success. Experience the distinct advantage of AT&T Business’s converged network with LevelBlue's managed security services to learn how organizations can seamlessly blend security with innovation.

Become a Sponsor

Continuing Professional Education (CPEs)

ISC2

Those who are certified through ISC2 can earn 5.5 Continuing Professional Education (CPE) credits for attending the CISO Summit.

Black Hat does not maintain records of earned CPE credits. However, we will report your credits to ISC2 on your behalf after the event. Please provide your ISC2 member number when registering for the event.

For questions about credits for CISO attendees, e-mail cisosummit@blackhat.com.