~ Agenda

Attackers are evolving with AI faster than we realize and defenders must do the same. In this gamified, interactive session, explore how adversaries are leveraging AI for evasion, automation, and scale. Then map those tactics to AI-driven defenses within SentinelOne. Participants will engage in scenario-based exercises to anticipate attacker behavior and strengthen proactive security strategies.

Harness the full power of AI-driven investigations across the Singularity Platform. In this hands-on session, you’ll learn how AI correlates telemetry, accelerates root cause analysis by correlating across multiple storylines, and implement hands-off vs human-in-the-loop AI. Walk away with repeatable, AI-assisted workflows that dramatically reduce mean time to respond (MTTR) and elevate analyst efficiency.

AI is only as strong as the data behind it. This session focuses on designing, optimizing, and scaling data pipelines that fuel SentinelOne’s AI SIEM. Learn how to ingest, normalize, and enrich, high-volume telemetry to improve detection accuracy, reduce noise, and unlock more powerful AI-driven insights across your environment.

As AI adoption accelerates, so do new risk surfaces. This session focuses on security in your AI ecosystem, from models and training data to prompts and outputs. Learn how to identify vulnerabilities, enforce governance, and apply SentinelOne’s capabilities using Prompt to monitor and protect applications across the organization.

Manual processes slow down security teams when speed matters most. In this session, you’ll design and implement hyperautomation workflows using SentinelOne to orchestrate detection, investigation, and response. Learn how to eliminate repetitive tasks and enable autonomous security operations at scale.

This session explores SentinelOne's capabilities of Identity and Endpoint protection. Through instructor demonstrations and discussion, you will learn how identity protection complements endpoint detection, enabling faster, more confident response decisions.

Join Arete for a deep dive into real-world incident response engagements where collaboration and technology made the difference between disaster and recovery. In this session, we’ll walk through high-impact cybersecurity breaches where Arete’s incident response team leveraged SentinelOne’s autonomous platform—including Endpoint Detection and Response (EDR), AI-powered SIEM, and STAR detections—to investigate, contain, and remediate the threat.

Every autonomous SOC capability — detection, investigation, AI-driven response — runs on the data underneath it. Noisy, unstructured data means noisy outcomes: more false positives, slower investigations, more analyst hours lost to triage. See how Singularity AI Data Pipelines fixes it at the source, cutting log noise by up to 80% before it ever reaches AI SIEM, and leave with a blueprint for delivering the right data, to the right place, instantly.

Attackers don't always come through the network. In high-security environments, connectivity blind spots create risks that traditional tools weren't built for, making the isolation itself the vulnerable blind spot. No connectivity means zero visibility against threats originating from the inside or out.

This session covers how to protect fully isolated, compliance-heavy, or data-sovereignty-constrained environments. Learn how to extend endpoint security to systems that can't touch the cloud, see what that architecture looks like in practice, and discover how teams get total coverage without compromising isolation requirements.

AI deployments rely on a complex cloud AI supply chain that extends far beyond the model itself. Hidden relationships between AI services, data, identities, and infrastructure can create exploitable attack paths that traditional security tools often miss. This session explores how attackers leverage these interconnected risks and how security teams can discover, prioritize, and remediate the exposures that matter most across their cloud AI environments.

AI is changing both sides of the security equation. Frontier models and autonomous agents can now discover vulnerabilities, analyze code, and identify attack paths at a speed and scale no human team can match. Open source maintainers are already drowning in AI-generated bug reports, while enterprise security teams face the same challenge: more findings, more noise, and too little context. The risk is not simply that AI will uncover more weaknesses, but that attackers can compress the time between discovery and exploitation and operate at machine speed. Defenders need AI security strategies that can validate findings, separate genuine risk from plausible-looking noise, and prioritize what matters most. In this session, we’ll explore how Wayfinder Frontier AI Services combines agentic workflows with expert analysis to deliver validated, high-impact findings teams can confidently act on.

SentinelOne runs an AI innovation lab that has been at work for the last year using the latest in frontier AI capabilities, putting agentic SOC use cases through their paces. Hear from product leadership how we test frontier AI against real SOC operations, what we learned about trust, automation limits, and human oversight, and what's on the horizon. This is a look at where the Autonomous SOC goes next.

When the mission is critical but resources are tight, IT and security can’t afford to operate in silos. See how NinjaOne and SentinelOne work better together, helping organizations like SJRC Texas (a child and family well-being nonprofit) turn everyday IT operations into a first line of defense. By uniting endpoint management with autonomous security, lean teams can stay ahead of risk, protect every device, and strengthen security without adding complexity, headcount, or compromising operational stability

Get an exclusive security update from our experts and threat researchers on the underworld activities of The Com. Learn about their origins, evolving ecosystem, emerging tactics and targeting, and the expanding investigative and law-enforcement response. Please note: Due to the sensitivity of the content, attendees will be asked to power off laptops and cellphones for the duration of the session.

AI has forever changed the scale and speed of cyber attacks. SentinelOne leads in runtime detection and response. Tenable leads in exposure intelligence and prioritization. Together, they deliver continuous threat exposure management that preemptively identifies and responds to threats at machine speed: from "what's exposed" to "what's being exploited" to "threat contained." Attend this session to see what best-of-breed CTEM looks like when two category leaders unite.

OT environments carry a unique set of challenges: legacy systems that can't be patched without risking downtime, proprietary protocols never built with security in mind, air-gapped networks, and converging IT/OT boundaries that widen the attack surface. The threats are real and growing, from ICS-specific malware, nation-state threats, supply chain attacks, insider threats, and remote access vulnerabilities.

This session covers the OT Threat landscape, how SentinelOne secures OT and critical infrastructure and how we can help achieve compliance in these high-stakes environments. We'll cover our self-hosted portfolio, including a sneak peek of our UniConsole, our unified console for managing on-prem environments, in addition to new on-prem product capabilities such as Singularity Application Control and RemoteOps Forensics. We'll also unpack how SentinelOne is helping better secure Experion PKS customers over legacy providers.

While the exposure backlog piles up, the real question remains: which exposures are actually exploitable and what to fix first? Most teams tackle this by layering on a different tool for every surface, each with its own agent, separate console, and a disconnected view of risk. SentinelOne closes that gap in a single platform: the same agent already protecting endpoints extends into the network to surface unmanaged devices, while an agentless approach covers cloud assets and AI services across multi-cloud environments. Teams can automate pre-approved, remediation workflows, all in the same tool. This session includes a live walkthrough of the full path, from exposure to remediation without leaving the console. JetBlue joins this session to share their risk management journey with SentinelOne, from EDR and managing vulnerabilities, and the benefits of consolidating their teams and workflows into a unified platform.

Join SentinelOne's Head of Product for Prompt Security to dive into the latest innovations and what's next on the AI Security roadmap. We'll cover some of the most impactful upcoming investments across AI Usage Control, AI Application Security, and Agentic AI Security. We'll walk through the vision, strategy, and product roadmap designed to secure AI at every stage and how it all connects with the Singularity Platform.

Cyber priorities. Policy shifts. Funding outlooks. Get the critical insights and product updates straight from SentinelOne’s Public Sector leadership team. Join a candid customer panel on how AI-powered SecOps drives better mission outcomes. Connect with industry peers over thought leadership and a hosted networking lunch.

Modern attacks rarely stop at the endpoint. They pivot to identity. In this hands-on workshop we follow an attacker from a compromised credential on a SentinelOne-protected device through reconnaissance, lateral movement, and Active Directory attacks such as Golden Ticket and DCSync. See how existing EDR customers can extend the same agent with Singularity Identity to detect credential misuse and lateral movement, use deception decoys for high-fidelity alerting, and close the AD misconfigurations that made the attack path possible in the first place. And as AI agents become identities in your environment, the same framework applies.

Join us to discover the exciting new features and capabilities coming soon to SentinelOne's attack surfaces portfolio. We'll cover some of the most impactful upcoming investments across Endpoint, Identity, Cloud, and Exposure Management, giving customers a clear picture of what's coming in the near-to-mid term. We'll walk through the vision, strategy, and product roadmap designed to protect customers from advanced threats, and set them up for success against evolving risk.

Threat intelligence has never had more data. Telemetry, actor reporting, and vulnerability disclosure exist at a scale the industry has never seen. The problem is turning that knowledge into action fast enough to make a difference. This talk looks at how attacker tempo is compressing and how AI is lowering the cost of research, exploitation, deception, and scale. It covers PRC-nexus AI-assisted vulnerability research, DPRK remote-worker infiltration, and why strategic attack surfaces may be a more durable planning unit than individual CVEs. It closes with a practical discussion around how we need to adapt our defenses in response to this growing threat.

Attacks move at machine speed. Can your SOC keep up? 451 Research analyst Mark Ehr unveils 2026 survey data from 600+ security leaders: 98% are ramping up AI investment, yet only half have gone live, a third are still testing the waters. Almost none have made the jump to full trust. Join SentinelOne customers from Wyndham, Nebraska Medical Center, and Alliant Credit Union as they react live to the findings, sharing what matches reality and what falls short. You’ll learn where they are on their journey with experimenting with AI to trusting it in SecOps production, how it's impacting training, MTTR, and alert fatigue, plus what they have planned next.

Most SOCs don't have a detection problem. They have a "what happens next" problem: alerts that sit in a queue, handoffs that stall, and containment that waits on the wrong approval. Two experts from LevelBlue's global managed security team share the operational changes that have shortened dwell time and sped up response across endpoint, cloud, and identity environments running SentinelOne, including public sector environments. Expect specific fixes to triage, escalation, and playbook design, drawn from real investigations, along with the mistakes behind each lesson. You'll leave with steps you can apply to your own SOC, whether you run it in-house or with a partner.

Get an exclusive security update from our experts and threat researchers on the underworld activities of The Com. Learn about their origins, evolving ecosystem, emerging tactics and targeting, and the expanding investigative and law-enforcement response. Please note: Due to the sensitivity of the content, attendees will be asked to power off laptops and cellphones for the duration of the session.