Traditional administrative models are struggling to keep pace with today’s threat landscape. This session examines the evolution of privileged access management through Tiering 2.0, administrative forests, and Privileged Access Workstations (PAWs). Attendees will learn how to design resilient administrative environments, reduce credential exposure, and build architectures that limit the impact of identity compromise while supporting modern hybrid infrastructures. 

Learn how AI agents can analyze infrastructure, configurations, identities, attack paths, vulnerabilities, and security telemetry to create a comprehensive security profile of an organization. The session demonstrates practical approaches for identifying weaknesses, prioritizing remediation efforts, and accelerating security assessments using AI-assisted analysis. 

A secure environment starts with a strong foundation. This session explores practical approaches to assessing and hardening Windows Server environments against modern attack techniques. Attendees will learn how to evaluate security baselines, identify common configuration weaknesses, prioritize remediation efforts, and implement controls that reduce attack surface while maintaining operational efficiency. Real-world examples will demonstrate how seemingly minor misconfigurations can lead to significant security exposures. 

As identities become the primary target for attackers, organizations must rethink their defensive strategies. This session focuses on securing Microsoft Entra ID and hybrid identity environments against modern threats. Participants will explore attack paths targeting synchronization services, privileged identities, conditional access policies, and authentication mechanisms while learning practical techniques for monitoring, detection, and risk reduction. 

Databases often contain an organization’s most valuable information, making privileged accounts highly attractive targets for attackers. This session explores common techniques used to abuse elevated database privileges, establish persistence, and access sensitive information. Attendees will learn how to detect suspicious administrative activity, monitor for indicators of compromise, and implement defensive controls that strengthen database security without disrupting business operations. 

Security Operations Centers are entering a new era where AI is becoming an active participant in detection, investigation, and response. This session examines how AI-powered workflows can assist analysts by automating repetitive tasks, accelerating investigations, correlating telemetry across multiple platforms, and uncovering hidden attack patterns. Attendees will gain practical insights into building a modern SOC that combines human expertise with AI-driven decision support. 

Successful investigations require more than collecting evidence. They require understanding the complete story behind an attack. This session demonstrates how to correlate endpoint, identity, cloud, and forensic artifacts to reconstruct attacker activity from initial access through persistence, lateral movement, and objectives. Attendees will learn practical investigation methodologies and discover how seemingly unrelated artifacts can reveal critical insights about an adversary’s actions. 

The arrival of quantum computing presents one of the most significant cryptographic challenges organizations have faced in decades. This session explores the latest developments in Public Key Infrastructure and the transition toward post-quantum cryptographic algorithms. Participants will gain an understanding of emerging standards, migration challenges, certificate lifecycle considerations, and practical steps organizations can take today to prepare for a post-quantum future. 

Digital certificates underpin modern authentication, encryption, and trust. This session provides a practical deep dive into designing, deploying, and securing enterprise PKI using Microsoft Active Directory Certificate Services. Attendees will learn best practices for certificate lifecycle management, common implementation pitfalls, security considerations, and how modern PKI supports identity-first security strategies across hybrid environments. 

Despite the rise of cloud services, Active Directory remains the backbone of identity for many organizations. This session focuses on protecting on-premises AD environments against modern attack techniques regardless of whether they operate in connected or isolated environments. Participants will learn how attackers target AD, what defensive controls provide the greatest value, and how to build a resilient identity infrastructure capable of withstanding today’s threats. 

Hybrid infrastructures introduce new visibility challenges and attack opportunities. This session explores modern approaches to cloud security monitoring and detection engineering, focusing on Microsoft cloud environments and hybrid architectures. Attendees will learn how to build meaningful detections, identify cloud persistence techniques, correlate activity across environments, and improve visibility into attacker behavior without overwhelming security teams with noise. 

Browser extensions have become one of the fastest-growing attack surfaces in modern enterprise environments. This session explores the risks associated with unmanaged extensions, including credential theft, session hijacking, data exfiltration, malicious updates, and supply chain compromise. Attendees will learn how to assess extension-related risks, implement governance strategies, monitor extension activity, and build controls that reduce exposure while maintaining user productivity. 

Attackers increasingly rely on legitimate operating system tools to evade detection and blend into normal administrative activity. This session focuses on monitoring and detecting Living-Off-the-Land Binaries, Scripts and Libraries (LOLBAS) commonly abused during modern attacks. Attendees will learn how to identify suspicious usage patterns, distinguish malicious activity from legitimate administration, and develop monitoring strategies that improve detection effectiveness while minimizing false positives. 

PowerShell remains one of the most powerful tools available to investigators and incident responders. This session demonstrates how PowerShell can be leveraged to collect evidence, analyze system artifacts, investigate suspicious activity, and automate forensic workflows at scale. Attendees will learn practical techniques for accelerating investigations, validating findings, and uncovering attacker activity using native Windows capabilities and advanced PowerShell-based forensic methodologies. 

As physical attack techniques continue to evolve, organizations must revisit how they protect data at rest. This session explores modern BitLocker deployment strategies, secure PIN implementation, TPM-based protection mechanisms, recovery key management, and defenses against attacks such as YellowKey. Attendees will learn practical approaches for strengthening endpoint protection and reducing the risk of credential theft and unauthorized access through physical compromise.