Topic starter
24/10/2026 8:48 pm
TL;DR: Clarity Security’s guide to ISC2 Security Congress 2026 says nearly 200 sessions across five days are converging on one theme: AI agents are entering production faster than security programs can govern their access, accountability, and drift. The practical challenge is no longer whether agents matter, but how to choose sessions that map to identity, risk, and control decisions.
Editorial analysis by NHI Mgmt Group, based on content published by Clarity Security: “ISC2 Security Congress 2026 Session Guide: What to Attend”.
By the numbers:
- Nearly 200 sessions run across five days at ISC2 Security Congress 2026.
Key questions
A: Security teams should use these events to pressure test how they govern AI interactions, not just market their AI plans.
Q: Why do AI agents create a governance problem even when the protocol is approved?
A: Because the protocol only moves traffic, it does not define authority.
Practitioner guidance
- Map conference sessions to governance decisions, not job titles. Build your Security Congress plan around the control questions you need answered, such as agent scope, approval boundaries, audit evidence, and incident attribution.
- Prioritise sessions on AI agent authority and delegated access. Focus on talks that address what agents may access, how permissions expire, and how human approval fits into the workflow.
- Use tabletop scenarios to test governance drift. Walk through a case where an approved AI workflow expands into new data or tools and decide who must approve the change, what evidence is required, and when to halt execution.
Bottom line: AI agents are now a governance and identity issue, not just a technology trend, because they can expand authority faster than review cycles can keep up.
What to expect at the briefing
Clarity Security’s full conference guide covers the operational detail this post intentionally leaves for the source:
- Role-by-role session picks for Security Leaders, IAM, GRC, and Architects so you can build a personalised schedule
- Session timing and conference logistics, including workshop windows, expo hall hours, and limited-seat tabletop sessions
- Specific talk descriptions and speaker pairings for governance, agentic AI, IAM, and Zero Trust tracks
- On-site planning cues such as booth location, follow-up opportunities, and networking events
👉 Read Clarity Security’s guide to ISC2 Security Congress 2026 session planning →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/10/2026 11:12 am
AI agent governance is now an identity discipline, not an app-layer add-on. The agenda in this conference guide makes that clear: sessions on governance, context leaks, admissibility, and least privilege all point to the same operating reality. When agents can act across tools and data sources, identity is the control surface that determines whether the system stays bounded or drifts into unchecked authority. Practitioners should read this as a shift from tool adoption to governed execution.
A few things that frame the scale:
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What should teams do when an AI workflow starts using more data or tools than expected?
A: Treat that as a new governance event, not a minor configuration change. Pause the expansion, document the new scope, decide whether the original approval still applies, and confirm what evidence is needed before the workflow continues. If the change cannot be justified in writing, the workflow has outgrown its authorised boundary.
👉 Read our full editorial: AI agent governance dominates ISC2 Security Congress 2026 agenda