Keynote

The keynote opens with an analogy between human learning and large language models. People move information from short-term memory to working memory, then to specialized and foundational knowledge. LLMs have separate stages instead: the context window, retrieval-augmented generation, fine-tuning and the base model. The speaker argues that automating the movement between these stages is a central goal, and that smaller local models and faster chips will make real-time, increasingly autonomous AI practical.

Turning to enterprises, the speaker predicts that meetings will be recorded and searchable, documentation will update itself, status reporting will be automated, and models embedded in production systems will detect and fix problems. The persistent challenges facing security leaders are reporting, vulnerability management, least privilege, measurement, third-party incidents and detection and response. The speaker attributes them to three root issues: coverage, context and communication. A story about an unexpected public S3 bucket shows how hard it is to establish ownership and intent without broad visibility.

The talk closes with examples of how AI could attach context to alerts, support triage and translate findings for different audiences. On data risk, the speaker argues that leakage from a model itself is often overstated, but warns that sensitive material placed in vector databases can be returned to users. Enterprises should clean data before ingesting it, and training data poisoning is a real concern that has no settled fix.