Two clocks are running at once. Q-Day is when quantum computers break today's encryption, and under the EU's roadmap, high-risk use cases come off quantum-vulnerable crypto by 2030. The other clock is AI: attackers run reconnaissance and lateral movement through agents faster than any human team. These things compound: HNDL (harvest now, decrypt later) means stolen data waits for Q-Day, and AI-speed attacks mean that data was already taken way before most teams noticed. The session works through the path into a PQC migration, what defending against a machine-speed attacker looks like day to day, and how much crypto-agility the next transition demands.

The industrial revolution mechanized human muscle. Today, AI is mechanizing human thought, and the training data is the daily output of white-collar workers. Models flatter us, and teams ship code nobody has read. The same capabilities work for attackers, and we see agents already run large parts of real intrusions today. And that's when the agents don't decide to go rogue themselves. The EU AI Act excludes systems used exclusively for military purposes, and the UN General Assembly has voted on AI's role within autonomous weapons without producing a treaty. Muscle went first, thought is going now, and judgment is next unless we decide otherwise. You leave with three decisions: where a human stays in the loop, which skills you refuse to outsource, and what you ask of the people writing the rules.

The grace period is over, and it's not just one law anymore, it's many of them stacked on top of each other. Things like NIS2, DORA, the AI Act, or the CRA, each with its own deadlines, its own auditors, and its own fines, and they're all hitting your desk at the same time. Most companies run a separate program per law: separate owner, evidence, audit, the same control tested four times, and it still misses where the regimes disagree. We'll map where one piece of evidence satisfies NIS2, DORA, the CRA and the AI Act at once, and which controls carry most of the weight. You'll walk away with a practical map of the overlaps, a shortlist of controls that are designed to help you, and a governance plan that builds resilience, not just something to show auditors.

AI governance isn't just an engineering problem anymore - it affects the whole company. Costs spiral, employees use tools you've never approved, and vendors are embedding AI into software you already run. Writing policy is easy; it won't stop a data leak or a model that makes things up. If you want to keep your company safe, you have to move past policy and start using tools that actually watch what the AI is doing. This session gives you a practical plan to secure how your company uses AI. We cover how to find where AI is hiding in your business and assess those tools for risk; how to track your own AI development so you have an audit trail if something goes wrong; and how to set up guardrails that block a policy violation the moment it happens - without grinding operations to a halt.

Deepfakes are now cheap, fast, and good enough to fool both busy humans and corporate security controls. Voice fraud, executive impersonation, fake "leaks," and AI-generated video approvals for fraudulent wire transfers are no longer theoretical. Real attacks have already bypassed standard Zero Trust defenses by exploiting the one thing the architecture was built on: identity verification. This session covers how modern synthetic media is made, where it hits hardest, and the solutions that still matter. When an attacker can wear a manager's face on a live call, biometrics and voice authentication stop being controls. We'll walk through what replaces them: cryptographic identity, hardware-bound authentication (FIDO2), C2PA provenance-at-capture, and behavioral verification that current AI cannot trivially fake. At least, not yet. We'll also cover what the EU AI Act and platform disclosure requirements actually change - and what they don't. You'll leave with a practical checklist for your teams and a clear picture of how Zero Trust needs to evolve to survive the synthetic identity era.