SANS AI/SI Cybersecurity Summit Fall 2026 Recap: Key Takeaways for the Agentic Era

The SANS AI/SI Cybersecurity Summit Fall 2026 brought practitioners and security leaders to Arlington, Virginia, to work through a key challenge facing the cybersecurity community amid the rise of agentic AI. AI agents are taking on real authority inside the enterprise. They triage alerts, revoke tokens, isolate workloads, and in some environments shut down production services, often through the same identities and integrations attackers target.

Meanwhile, threat actors are using agents of their own to run reconnaissance, exploit vulnerabilities, and move laterally, reaching deep access in a fraction of the time intrusions used to take. That leaves organizations deciding how much authority to delegate to their own agents, and how to keep response processes built around human approvals from falling behind.

Over two days, summit speakers from government, cloud, finance, consulting, threat intelligence, and critical infrastructure all analyzed the current landscape from different ends of the spectrum. Five takeaways emerged across the keynotes, talks, and panels that point to actionable work organizations can start now.

Agent Authority Must Be Governable, Enforceable, and Provable

Most organizations can say how many agents they have in production. Far fewer can say who owns each one, what it's allowed to do, and how they would know if it went too far. Morgan Adamski, Principal, Cyber, Data, and Tech Risk at PwC, said authority granted to an agent must be governable, enforceable, and provable. Vinh Nguyen, Senior Fellow of AI at the Council on Foreign Relations, called accountability the top barrier to scaling AI, and he expects the CISO to inherit it.

Enforcement needs to live in the architecture. An agent that enriches an alert and one that can take down production need very different approvals, and Amy Herzog, Vice President/CISO at AWS, argued for permissions scoped to a single task and set to expire. Summit co-chair Sounil Yu explained why least privilege alone falls short. As models get more capable, their agency grows faster than the privileges teams grant them. "For a sufficiently intelligent agent, any privilege will be indistinguishable from root," he said.

Adamski suggested a drill to prove control. Pick one agent with real authority and simulate a compromised integration credential. Then see whether the team can find the agent's owner, cut its access everywhere, reconstruct what it did, and keep the service running.

The Basics Still Decide The Outcome

Herzog argued that attackers still succeed mostly through weak credentials and exposed systems, the "fundamental security vegetables that we have been talking about for 30 years." She described one attacker who used commercial AI tools to compromise more than 600 network devices in more than 55 countries without a single exploit. Adamski added that new technology can't make up for unfinished foundational work, and that organizations should plan for a successful attack.

Agents raise the stakes on that unfinished work. Adversaries are increasingly choosing to log in rather than break in, Adamski said. She pointed to the 2025 Salesloft Drift compromise, in which stolen OAuth tokens from one integration reached Salesforce environments across many organizations. John Hultquist, Chief Analyst at Google Threat Intelligence Group, noted that infostealers are already harvesting AI credentials. Nguyen warned that organizations that get agent identity wrong today will pay for it three to five years from now.

The fix starts with work security teams already know, including credential hygiene, closing exposed systems, and testing recovery. Herzog was clear that people remain central to that work, though their skills need to stretch into systems and safety thinking, and AI can help them get there.

Finding Got Cheap. Fixing Didn't.

Hultquist described intrusions using agentic frameworks that reached deep access in about 15 minutes, in cases that once took days. Those intrusions are often noisy, and they work anyway. Michael Collins, Senior Principal Security Engineer at Mastercard, added that expert-level exploit development is now within everyone's reach. His team points models at source code and live containers to generate working exploits, and the hardest part comes after discovery. "The problem is fixing these things," he said.

At that volume, treating every high-severity finding as equally urgent stops working. Day 2 speakers urged teams to rank work by what attackers exploit in practice and, where they can, rebuild systems instead of patching them. Many teams still patch by severity score because their governance requires it. Katie Moussouris, Founder and CEO of Luta Security, recalled CISOs telling Microsoft they would get in trouble for prioritizing any other way.

Measurement should change too. Herzog has dropped percentage-improvement targets in favor of one test, whether her team can mitigate faster than an attacker can act. A single SLA can hide the difference between an eight-hour fix and a 16-hour one, so she tracks response as a distribution from the fastest cases to the slowest.

The Harness Matters More Than The Model

Yu argued that each new model is a reason to rebuild the harness, the prompts, tools, and rules wrapped around it. A harness written for one model can hold a newer one back. He distinguished prescriptive harnesses, which are tied to a single model, from descriptive ones that can move with a team as models change. "Descriptive harnesses tend to transcend models," he said.

Collins described the same lesson in practice. His team sandboxes frontier models from day one and tests them against a replica of production. Left in a dev environment, he warned, an agent will find a way into prod. The team assigns different models to different tasks, uses cheaper ones for early discovery, and has one model fix what another found. Herzog warned against fixating on any one model and pointed out that containers are not a security boundary.

The investment worth making now is in the parts that outlast any single model. A useful test for a security team is whether its controls, workflows, and skills would still hold if it switched models next quarter. Independent sources matter too, and Joshua Corman, Executive in Residence for Public Safety and Resilience at IST, warned against learning about AI only from the people pushing adoption.

Critical infrastructure is Fragile, and The Fix Starts With Engineering

Corman argued that society now depends on digital systems that aren't dependable. For water, health care, and similar services, an outage is the whole game. His answer was to right-size that dependence by removing complexity and connectivity and adding engineering, which in many cases does more than adding cyber controls. Organizations also must rank what cannot fail. "When everything is critical, nothing is critical," he said.

The pressure on these systems is growing. Hultquist flagged industrial targets as a concern on Day 1, and Day 2 panelists added that AI helps attackers fill gaps in OT knowledge that once kept many groups out. The bench of people who can respond is thin. Corman estimated national capacity for OT and ICS incident response at about 120 people. Panelists urged consequence-based risk management over checklist thinking.

For utilities, water systems, hospitals, manufacturers, and logistics providers, consequence-based thinking starts with naming the systems that cannot go down without harm to people. The next question is who on the team could respond if those systems were attacked. Many IT-trained teams have little hands-on experience with industrial environments, so building that capability has to happen before an incident.

What Comes Next: SANS AI Cybersecurity Summit Spring 2027

Taken together, the five takeaways point to the same conclusion. Agents scale whatever an organization already has in place, including its gaps in ownership, identity, and remediation. Most of the work speakers recommended can start this quarter, and teams that begin now will have real results to compare when the community meets again.

Join us for the next round of these discussions at the SANS AI Cybersecurity Summit Spring 2027 in Denver, Colorado, on April 27 and 28. Register for the summit here.