2026 NYS Cybersecurity Conference Day 1

Welcome Address

Keynote: Outpacing the Adversary: Security in the Age of AI and Identity

Adam Meyers

In today’s threat landscape, adversaries don’t need to break in. They log in, move through trusted systems and act before defenders can respond, with breakout times as little as 27 seconds in 2025. The modern attack surface now spans identity, cloud, SaaS and the browser, where attackers abuse valid accounts and trusted workflows to evade detection.

This session breaks down how these attacks unfold, from initial access through lateral movement. Drawing on frontline experience supporting public sector and enterprise defenders, Adam Meyer will show where traditional approaches lose visibility and how organizations can adapt to defend against AI-enabled adversaries. Attendees will gain a clear view of how AI is accelerating both the scale and effectiveness of attacks, from automated reconnaissance to high-volume social engineering. With an 89% rise in AI-enabled attacks, defenders are under pressure to keep pace. By adopting AI-powered security that operates on real-time intelligence, organizations can stop attacks earlier and reduce risk.

Adam Meyers serves as CrowdStrike's Senior Vice President of Counter Adversary Operations and is one of the company's longest-tenured leaders, having joined in 2011 to build the intelligence framework that now underpins the Falcon platform. Mr. Meyers leads one of the most advanced intelligence organizations in the private sector – Counter Adversary Operations comprises more than 500 analysts, threat hunters, linguists, reverse engineers, AI researchers and geopolitical experts operating across a global footprint. Drawing on prior experience at the U.S. State Department, Mr. Meyers built Counter Adversary Operations around a foundational conviction: organizations don't have a malware problem, they have an adversary problem.

Counter Adversary Operations’ intelligence flows directly into the CrowdStrike Falcon platform. The team tracks criminal, state-sponsored and nationalist cyber adversary groups across the globe, producing adversary insights and actionable intelligence to protect enterprises, major financial institutions and critical government agencies worldwide. A world-renowned intelligence expert, Mr. Meyers frequently briefs senior U.S. government officials, the House Intelligence Committee, the Defense Intelligence Agency, the FBI, allied governments and boards of the world's most influential organizations. He is regularly interviewed on adversary threats across major broadcast, print and online media. He frequently speaks at leading industry events, and he is the co-host of the “Adversary Universe” podcast, a biweekly show on the latest adversary trends and techniques. In 2025, Mr. Meyers was named to the CyberScoop 50, and SC Magazine recognized CrowdStrike with its Best Threat Intelligence Technology award.

Making the Journey from Vulnerability Management to AI-Enabled Exposure Management: An Essential Move in Today’s Dangerous Cyber Environment

Christopher Jensen, Tenable

Vulnerability management (VM) is foundational-to-good cyber hygiene, but it is no longer enough. If it is truly risk-based and not reliant on static indicators such as CVSS, VM can play an essential role in protecting your network environment, but more is needed to block attackers who may find other means of gaining access. Cyberattack paths have exploded in number and complexity, with attacks coming from directions not even considered in the recent past. While attackers probe for the weakest link in your sprawling attack surface, and move laterally in search of valuable assets, security teams are often constrained by siloed, incomplete attack surface views, and they must rely on just-in-time detection and response to react to attackers’ moves. Proactively identifying and reducing the highest risks before attacks come is the most cost-effective and secure way to protect your network environment. Incorporating AI as a partner in that effort is a force multiplier that can maximize responsiveness and effectiveness.

An effective exposure management approach must be holistic, proactive and preventive, with a laser focus on these three key factors:

1. A unified view of all assets and associated software vulnerabilities, configuration vulnerabilities and entitlement (identity) vulnerabilities.
2. Predictive capabilities that enable understanding of relationships between assets, exposures, privileges and threats across an attack path.
3. Dynamic risk-based prioritization to continuously identify and address the exploitable vulnerabilities, misconfigurations and other attack paths that pose the greatest risk.

Artificial Intelligence – Navigating an Automated World

Elijah Cedeno, Multi-State Sharing & Analysis Center

Artificial intelligence (AI) is no longer an emerging technology. AI is already embedded in the tools, workflows and daily lives of government employees and the constituents they serve. This session provides SLTT cybersecurity professionals with a practical foundation for understanding AI: what it is, how it works, and where the risks live.

Developed by the MS-ISAC, this presentation covers the AI technology stack from machine learning and deep learning through large language models, retrieval-augmented generation, and agentic AI. Attendees will explore how AI is already shaping productivity suites, communication tools, and decision support systems and why the rapid, often informal adoption of these tools introduces serious security considerations including shadow AI and data exfiltration risk.

This session also features a deep dive into prompt injection, the top-ranked vulnerability for LLM applications according to OWASP, including real-world attack scenarios such as the Morris II worm.

Lastly, a curated set of resources from leading government, academic and industry organizations will be provided to support continued learning and AI risk management.

Tales from the Ransomware Attack Chain: A Technical Deep Dive into How Ransomware Actually Operates

Jordan Jeffer, Halcyon

Ransomware isn't just encryption with a ransom note – it's a full-spectrum intrusion that most organizations don't truly understand until they're staring at one. This talk pulls back the curtain on the modern ransomware attack chain, walking through the real technical stages, from initial access and credential harvesting through lateral movement, defense evasion, data exfiltration and the encryption event itself. Drawing on years of red team operations and hands-on ransomware incident response, Jordan breaks down the tools, techniques, and procedures (TTPs) that ransomware operators actually use in the wild.

What TV Cop Shows Can Teach You About How to Pass a Cybersecurity Audit, Survive an Incident Investigation and Win a Lawsuit

Mike Semel, Semel Consulting

Rose Ketchum, Semel Consulting

The first demand in any audit, investigation and lawsuit is for documentation. If it wasn’t documented at the time, it didn’t happen. Cybersecurity and compliance expert and CMMC Certified Assessor Mike Semel will show you how to prepare yourself based on his experience managing IT for regulated organizations, as a certified assessor, and as an expert witness in lawsuits. Certified compliance expert Rose Ketchum will share her advice. Rose and Mike will share real life examples, what you can learn from TV cop shows and how to get started immediately without buying expensive cybersecurity tools or learning new skills.

You will learn about:

• Policies: your best friend or worst enemy
• Procedures: documenting what you implement to meet your policies, and what is too little, too much, or just enough
• Evidence: how to build a library you can quickly access to prove that you consistently implemented your procedures to comply with your policies
• Training: the critical difference between handing an employee a policy and showing them what to do
• Legal agreements: while not a lawyer, Mike will share how his legal agreements protected him against liability and misunderstandings, including getting dragged into someone else's mess

Murder, Magicians and Messaging Forensics

Roderick Link, FBI

Kyle Neuberger, FBI

Please join FBI Albany for a cyberthreat landscape update and a recent case study.

ASIA Session 1

Paper: SBOM-Derived Dataset for Software Supply Chain Monitoring

Paper: go-safeinput: A Practical, Zero-Dependency Input Sanitization Library for Go Addressing MITRE CWE Top 25 Injection Vulnerabilities

Stopping Fraud Risk at the Front Door: IAM, Deepfakes and GenAI Identity Threats Facing State Government Systems

George Freeman, LexisNexis Risk Solutions

This session will cover:

• Identity & access management (IAM) failures, causes, and solutions
• Synthetic identity fraud impacting benefits, services, and licensing
• Third‑party & contractor identity risk
• Account takeover via SIM‑swap, MFA abuse, social engineering, and device compromise
• Biometric identity spoofing: why the call center is in the crosshairs

Agency online identity fraud is exploding across government agencies, fueled by the latest tools that create real-time deepfakes. DMVs, as well as numerous state benefits programs (including retirement), are being hit by ever-increasingly sophisticated identity fraud. Stop fraud risk using intelligent identity workflows to transparently expose or reject high risk, while lowering friction for trusted citizens. Learn how these robust deep-learning identity workflows are helping government agencies prevent current and emerging cyberthreats, as well as improve equitable access initiatives.

AI Governance in Production: From Policy to Practice

Gaby Martin, CGI

As organizations rapidly operationalize AI, the cybersecurity conversation must evolve beyond infrastructure and into the models themselves. AI systems introduce new risks: prompt injection, model drift, unintended data exposure and autonomous decision-making without oversight. This session explores how AI governance serves as a critical extension of security. We will examine practical mechanisms such as model monitoring, deployment controls, human-in-the-loop validation, guardrails, and continuous risk assessment to ensure AI systems remain secure, compliant and trustworthy in production. Attendees will gain a framework for understanding AI governance not as a policy exercise, but as an operational security discipline — one that protects data, decisions and organizational reputation.

Let’s Start at the Very Beginning (My Favorite Hacking TTPs)

Tyler Wrightson, Leet Cyber Security

Let's start at the very beginning, a very good place to start...

When you read, you begin with A, B, C. When you sing, you begin with do, re, mi. And when you hack, you begin with scan, pop, flee. After all these years, it's apparent that there are still foundational gaps in many cyber professionals' understanding of how hackers operate and how they actually identify targets, enumerate their systems, gain access and then impact an organization.

This is a jam-packed talk with plenty of technical detail on real world hacker techniques. Tyler will review as many of the most risky hacking techniques as time allows – that is, the most likely to happen with the highest impact. However, this talk is still approachable regardless of your technical knowledge.

From SIEM Complexity to Sustainable Security Operations: Migration and Data Lake Strategies for Government

Derek Gleich, Cribl

Nick Calderan, Cribl

Government security teams are increasingly operating in a multi-SIEM reality — balancing legacy platforms, new cloud-native tools, rising data volumes and growing pressure to retain more telemetry for compliance, investigations and threat hunting. This session presents a practical, vendor-neutral framework for SIEM consolidation and migration in government environments, including phased cutovers, dual-write strategies, data normalization and maintaining visibility during transition. It will also explore why pairing SIEM modernization with a smarter data lake strategy creates a more sustainable long-term architecture. By routing high-volume or lower-fidelity telemetry to lower-cost storage while preserving high-value data in the SIEM for detection and response, agencies can reduce cost pressure, improve flexibility, and avoid recreating the same challenges in the next platform transition. Attendees will leave with practical strategies for building a more resilient, scalable and cost-effective security data architecture.

Verizon DBIR

Philippe Langlois, Verizon

The Verizon Data Breach Investigations Report (DBIR) is an annual cybersecurity publication that analyzes real-world data breaches—examining how they happen, who is behind them, and how businesses can stay protected. Using global data, the report provides key insights to help companies stay ahead of evolving threats. Now in its 19th iteration, it serves as a vital component of cybersecurity risk management for businesses of all sizes. Go beyond the data with DBIR co-author Philippe Langlois as he breaks down how generative AI is augmenting attacks, analyzes the impact of shifting financial pressures, and shares how to protect your infrastructure against today’s most prevalent threats.

ASIA Session 2

Paper: Author Verification for Cheating Detection in Modified AI Text    

Paper: Beyond Plagiarism: Prompt Leakage, Sensitive Data Exposure, and Misinformation in Educational GenAI Use Cases

admin/admin — A Live Demonstration of ICS Incident Response

Jonathan Easton, NYS Division of Homeland Security & Emergency Services 

Noor Gravelle, NYS Division of Homeland Security & Emergency Services

Scott Sparks, NYS Division of Homeland Security & Emergency Services

Nick Waugh, NYS Division of Homeland Security & Emergency Services

Yaarub Salih, NYS Division of Homeland Security & Emergency Services

Patrick Furlong, NYS Division of Homeland Security & Emergency Services

Gain a practical understanding of how cybersecurity measures impact the resilience of industrial control systems (ICS). This session showcases real-time attack and response scenarios, illustrating the tangible benefits of preparedness and layered defenses. The scenario uses a HMI, network monitoring and attacker techniques drawn from real-world ICS incidents to show how security controls affect outcomes. Attendees will see detection happen in real time, see response decisions made with good and bad information, and understand how layers of defensive capability contribute during an incident. The session is designed for security practitioners, OT operators and anybody who wants a practical example of what good preparation looks like in an OT environment, as well as how it impacts the ability to respond to and recover from an incident.

Demonstration objectives include:

• Understand the practical application of cybersecurity controls in preventing and mitigating ICS cyberattacks.
• Appreciate the critical role of an ICS-specific incident response plan in minimizing damage and ensuring operational continuity.
• Grasp the necessity of accurate asset inventories and network diagrams.
• Value the importance of network visibility in detecting and responding to threats within ICS.

Next-Gen NYSOC: AI-Powered Efficiency

Brad Reimers, Deloitte

Michael Agiovlasitis,  NYS Office of Information Technology Services

Deloitte, in collaboration with NYSOC/the New York State Office of Information Technology Services, will highlight the importance of AI/ML capabilities within the NYSOC through an informational session and live demo of the NYSOC AI Assistant, showcasing in-house developed skills. The session will also preview future enhancements, such as AI-enabled SOC hygiene management, which automates SOC activities and generates recommendations with human-in-the-loop validation embedded directly in analyst workflows. This capability improves efficiency and standardization across SOC operations. This topic underscores how ITS continues to evolve with the technology landscape.

How We've Gone Completely Phishing-Resistant (And So Can You!)

Eric Woodruff, Semperis

Phishing-resistant authentication is shifting from optional to mandatory. Not only are attackers using phishing as the primary mechanism to evade traditional forms of MFA, but they are also evolving their attacks to find ways around implementations where phishing-resistant authorization is only preferred and not enforced. The road to deploying passkeys, Windows Hello for Business and Mac Platform SSO looks easy enough in the Microsoft docs, but what does it look like to implement them as mandatory across a workforce? In this session we’ll cover how we went from a handful of FIDO2 keys to phishing-resistant authentication across our enterprise in Entra ID at breakneck speeds. We’ll explore the ins and outs from a technical and organizational perspective of the implementation, as well as the “gotchas” we hit along the way and how we overcame them. We’ll cover edge cases, as well as how deploying passkeys is just part of the bigger equation to going phishing-resistant. We’ll also examine phishing attack trends, which helped inform and shape policy so that phishing-resistant authentication isn’t an option – it’s the only option.

Cloud Hangover: The Economic Case for Bringing Workloads Home

Christopher Williams, RSA

For years, "cloud-first" was the undisputed corporate mandate. But as the "honeymoon phase" ends, organizations are facing a sobering reality: spiraling egress fees, unpredictable AI infrastructure costs and the loss of architectural control. We are now entering the era of the "Great Correction." This session breaks down the latest 2026 data revealing why over 80% of enterprises are repatriating key workloads to on-premises environments. We will move beyond the buzzwords to examine the financial "tipping points" of steady-state computing and the impact of the Broadcom-VMware shift. Attendees will gain a data-driven framework to identify which services belong in the hyperscale cloud and which are more efficient, secure and cost-effective under their own roof. It’s time to stop chasing the cloud and start optimizing the business.

Using AI for Good, Not Evil: Latest Threat Trends and How to Defend at Scale

Preston Miller, Palo Alto Networks

Well-funded cyber threat actors are continuously innovating in machine learning, automation and artificial intelligence (AI). Even worse, threat groups are now making their malicious tools and support available to non-sophisticated criminals. These “ransomware-as-a-service” offerings have significantly lowered the technical barriers to entry, further increasing the volume and pace of successful cyberattacks. This session will cover each of these threat trends, what to expect with the emergence of AI, and real-world examples of how these technologies can impact organizations when used for evil. On the flip side, we’ll discuss how to apply the same principles to scale up and accelerate our security operations. We must transform from a manual model built on human-driven triage to a new approach that makes automation the foundation of the SOC. By automating workflows, augmenting human analysts with ML-driven intelligence, and orchestrating response activity across tools, we will dramatically improve our security posture and overall resiliency.

ASIA Session 3

Paper: Meta Generative AI and Appreciative Inquiry: Pedagogic and Research Innovations within QASANs for Transparent, Self-Improving Agentic AI in the Post AI-Quantum Era

Paper: Hybrid Deep (CNN-BiLSTM) Learning-Based Intrusion Detection   
 

Calm Before the Storm: Incident Readiness Through the CIS Critical Security Controls

Valecia Stocchetti, Center for Internet Security

Effective incident response does not begin at the moment an incident is detected. In other domains, such as fire response, preparedness is established well in advance through detailed pre incident planning. Firefighters rely on documented knowledge of building layouts, critical systems, access points, and risk factors to respond safely and effectively. That preparation does not prevent a fire, but it significantly improves the speed, safety, and effectiveness of the response.

Cybersecurity incidents follow the same principle. When an organization experiences an event such as a ransomware attack, response teams are required to act immediately. Systems may be disrupted in rapid succession, data may be staged for extortion, and business operations may be impaired within minutes. In these conditions, effective response depends on having immediate access to accurate information: asset inventories, data classifications, access paths, dependencies and recovery priorities. Without that context, incident response becomes reactive, slower and more prone to errors.

Governance, risk and compliance (GRC) programs play a critical role in enabling effective incident response. A mature GRC program, particularly one aligned with the CIS Critical Security Controls, establishes the foundational knowledge and processes that incident response relies on. Activities such as risk assessments, asset management, access governance, logging, backup planning and data protection not only reduce the likelihood and impact of incidents, but also ensure that responders have the information required to contain, investigate and recover from them. Incident response plans, business continuity plans, disaster recovery strategies, training and tabletop exercises are the operational outcomes of sustained governance and risk management efforts, not standalone artifacts created in isolation.

The distinction between proactive preparation and reactive response is decisive. Organizations that invest in governance and risk management before an incident occurs are better positioned to respond decisively and coherently when one does. By establishing a consistent cadence of assessment, planning and validation, organizations improve resilience and reduce uncertainty during high impact events.

This session examines how incident response and GRC function as complementary disciplines, how the CIS Critical Security Controls provide a common foundation for both, and how organizations can strengthen their incident response capabilities by maturing their governance and risk management practices.

Asymmetric AI Defense: Shadow AI to Secure AI on a SLED Budget

Sam Kinch, Tanium

Two days ago, a threat actor called TeamPCP poisoned LiteLLM, an AI library downloaded 3.4 million times per day, by compromising a security scanner in the project's own CI/CD pipeline. The attackers obtained PyPI credentials through a prior compromise of Trivy, an open-source security scanner used in LiteLLM's pipeline Snyk, then published backdoored versions containing credential-stealing malware. The compromise has spread across five ecosystems including GitHub Actions, Docker Hub, npm, and PyPI, per The Hacker News.

This is not hypothetical risk – it is the threat landscape you are defending against right now, and it is accelerating. State and local agencies are moving past AI experimentation and growing wary of hype. Meanwhile, Shadow AI is already present: unsanctioned tools, unmanaged data flows, and well-intentioned automation quietly increasing risk. This session offers a practical, public-sector-ready playbook for moving from AI curiosity to governed, measurable cybersecurity outcomes. We will cover three areas agencies can act on now.

• First, shadow AI: how to discover where AI is already in use and implement lightweight, enforceable controls without slowing mission delivery.
• Second, agentic AI in cyber defense: how to safely pilot goal-driven AI automation using human-in-the-loop approvals and staged rollout.
• Third, asymmetric AI strategy: how defenders can use automation and real-time visibility to make defense faster and cheaper than the attacker's next move.

Attendees will leave with three ready-to-use documents: a Minimum Viable Shadow AI Policy template, an AI Cyber Defense Control Checklist aligned to zero trust, and a 30/60/90-day automation roadmap.

Cybersecurity for the Public Sector with Leveraging Cloud

Andy Rivers, Amazon Web Services

The public sector threat landscape is evolving faster than most government IT teams can track, and attackers are using AI to widen that gap. This talk unpacks the latest threat intelligence shaping federal, state and local agencies, from ransomware campaigns calibrated to specific government tiers to AI-amplified attack vectors that stress test even well-resourced teams. The talk will convey a practical framework for building resilient, recovery-ready infrastructure; evaluating trusted security partnerships; and deploying generative AI as a defensive force multiplier.

Beyond the Tool Trap: Building a Cohesive Data Defense Strategy

AJ Debole, Oracle Cloud

Developing a comprehensive defense-in-depth cybersecurity strategy can be daunting. Many organizations fall into the trap of layering individual technologies or tool providers without first defining a cohesive strategy that supports business objectives. In this session, we will dive into defense-in-depth strategies designed to lock down your most valuable asset: your data. We will explore how to build a multi-layered security strategy using preventative controls like encryption and masking to keep intruders out. We will also examine detective controls, which include database firewalls and activity monitoring, to identify risky activities as rapidly as possible. Finally, we will cover administrative controls to ensure only the right human and non-human identities are properly authenticated and authorized to view data. The arrival of AI has shifted the incentive for getting this foundational hygiene right. A dependable security foundation is now a prerequisite for security of AI, security in AI and security with AI. By unifying these controls, you create the safe guardrails necessary for AI agents to operate as force multipliers rather than sources of new risk.

From Pyongyang to Your Payroll: Unmasking North Korean IT Workers through CTI and Collaboration

Jeremy Miller, Nelnet

This session plays a critical role in helping organizations understand and respond to the evolving threat landscape. This presentation explores how intelligence sharing and cross-organizational collaboration can turn emerging threat information into meaningful defensive action. Using a real-world example, the session examines how threat intelligence helped identify and address the growing risk of North Korean operatives posing as remote IT workers within legitimate organizations.

The presentation highlights how intelligence shared through industry partnerships, including the FS-ISAC, provided early insight into a scheme in which North Korean actors obtain remote IT employment with foreign companies. These operatives use fabricated identities, intermediaries and distributed infrastructure to secure positions, generate revenue for the regime and potentially gain access to sensitive systems and data. Attendees will learn how cyberthreat intelligence can move beyond passive reporting to become an operational capability that informs real decision making.

The session walks through the process of analyzing shared intelligence, assessing organizational exposure and coordinating a response across cybersecurity, IT and human resources teams. This collaborative approach allowed the organization to better understand the threat, evaluate hiring and access processes, and implement mitigation strategies to reduce risk. Participants will leave with practical insights into how CTI can strengthen organizational defenses, improve cross-team communication and support proactive security strategies. The presentation emphasizes that intelligence only delivers value when it leads to action and that effective collaboration across teams and organizations is essential to identifying and disrupting emerging threats before they become incidents.

ASIA Session 4

Paper: Covert Communications in NFTs

Paper: Canary: A PowerShell Framework for HIPAA Infrastructure Compliance in Small Healthcare Practices