Notifications
Clear all
Topic starter
18/08/2026 2:51 pm
TL;DR: Cybersecurity conferences in 2026 are shifting from broad threat briefings toward agentic development security, software supply chain governance, and AI guardrails, according to Cycode. The agenda change matters because security teams now need peer benchmarks, operational playbooks, and cross-functional forums that translate AI risk into concrete development controls.
NHIMG editorial — based on content published by Cycode: Cybersecurity Conferences Worth Attending in 2026
By the numbers:
- Gartner projected worldwide information security spending would reach $213 billion in 2025 and grow another 12.5% to $240 billion in 2026.
- Verizon’s DBIR 2025 covered 22,052 security incidents and 12,195 confirmed breaches across 139 countries.
- Verizon found that third-party involvement in breaches doubled year over year from 15% to 30%.
Questions worth separating out
Q: How should security teams choose cybersecurity conferences in 2026?
A: Security teams should choose conferences by the quality of implementation content, not by attendance numbers or brand recognition.
Q: Why do agentic AI and software supply chain sessions matter to IAM teams?
A: They matter because AI-driven development changes who or what is requesting access, approving actions, and moving code.
Q: What do organisations get wrong when they treat conference attendance as awareness only?
A: They often collect information without using the event to sharpen control decisions.
Practitioner guidance
- Prioritise agentic development sessions over generic threat briefings Build your 2026 conference shortlist around events that cover AI agents, machine identity, and policy enforcement in the software factory.
- Use supply chain sessions to test your credential lifecycle assumptions Ask whether the agenda covers CI/CD secrets, build-system access, provenance verification, and offboarding of automation credentials.
- Compare conferences by implementation depth, not audience size Score events on whether they include hands-on workshops, peer roundtables, regulator participation, and cross-functional sessions with developers and security leaders.
What's in the full article
Cycode's full blog covers the operational detail this post intentionally leaves for the source:
- Conference-by-conference notes on speaker mix, audience fit, and which event types are better for AppSec, product security, or executive networking.
- The specific agenda themes Cycode highlights for RSAC, Black Hat, OWASP Global AppSec, and specialist events.
- Practical guidance on virtual tiers, live Q&A, and on-demand formats that affect how teams use conference content.
- Cycode's own conference and summit priorities, including the Agentic Development Security Summit and related programming.
👉 Read Cycode’s guide to the best cybersecurity conferences in 2026 →
Cybersecurity conferences in 2026 - are your priorities changing fast?
Explore further
18/08/2026 3:33 pm
Agentic development is now an identity governance problem, not just an AppSec theme. Once AI systems can write and move code, the relevant control plane expands to include the identity of the agent, the scope of its tool access, and the lifecycle of the credentials it uses. That intersection is where IAM, PAM, and NHI governance now meet software delivery. Practitioners should treat agentic development sessions as architecture sessions for machine identities.
A question worth separating out:
Q: Who should be accountable for agentic development security and supply chain governance?
A: Accountability should sit across AppSec, platform engineering, IAM, and risk leadership, because the failure points span code, identity, and release operations. The right owner is the team that can enforce policy at runtime and prove it across the delivery chain. If ownership is fragmented, the control gaps will be too.
👉 Read our full editorial: Cybersecurity conferences in 2026 are shifting toward agentic security
