ISACA GRC 2026: The Sessions You Shouldn’t Miss

ISACA GRC 2026 brings together compliance, risk, audit, and technology leaders at a moment when the profession is being asked to do more with less certainty — more AI, more regulation, more organizational pressure to move fast without breaking things. The agenda reflects that tension, with sessions ranging from the deeply practical to the genuinely provocative.

With three days and dozens of sessions, choosing where to spend your time matters. Here’s a curated guide by role to help you build a schedule worth keeping.

Before the Sessions Start

Get to the conference early on Monday. Breakfast and networking runs from 7:00–8:30 AM, and the conversations that happen before the first session are often the ones worth having. The exhibit hall is open both Monday and Tuesday, with lunch and networking followed by coffee and desserts in the hall both afternoons. Monday evening closes with a Welcome Reception from 5:45–6:45 PM — the best unstructured networking opportunity of the conference. If you’re only going to attend one social event, make it this one. Tuesday’s exhibit hall closes at 4:00 PM, so don’t leave booth visits to the end of the day.

Monday, August 17

8:30–10:15 AM — General Session

Tarah Wheeler, Cybersecurity Expert & White Hat Hacker

Wheeler opens the conference with a practitioner’s read on the current threat landscape — what’s actually happening and what it means for the organizations in the room. Her background as a white hat hacker means this isn’t a theoretical overview. Don’t skip it.

10:15–10:45 AM — Networking Break

First chance to walk the exhibit hall and refill on coffee before the concurrent sessions start.

10:45–11:45 AM — Concurrent Sessions

Compliance & Risk	IT Audit	IT & Technology Leaders
CS 1-5: The Emergence of the GRC Hero Sid Roper, Head of GRC Engineering, Compyl	CS 1-3: Red Flags & Green Wins: Inside the Extreme Audit Playbook Arnulfo Espinosa Dominguez, President, ARES Alliance	CS 1-6: Engineering an Agentic System of Action for Modern GRC Richard Marcus, CISO, Optro
Practical strategies for building GRC programs that deliver measurable impact without last-minute heroics How to position yourself as a strategic advisor to the business rather than a compliance enforcer Frameworks for influencing executive decision-making and earning a seat at the table	An interactive format that challenges audit habits in real time: red card for outdated practices, green for modern ones Honest examination of why some assurance approaches fail while others build resilience Practical takeaways for auditors who want to modernize their methodology without abandoning what works	How to move beyond AI summarization to agentic systems that execute end-to-end GRC tasks autonomously A practical walkthrough of Model Context Protocol as a secure intelligence layer for live GRC data How to build governance guardrails into autonomous systems so they remain transparent and accountable

11:45 AM — Quick Break

Grab a coffee and swing by Booth 207 (Compyl) or Booth 312 (Optro) to continue the conversation from the session you just came from.

12:00–12:30 PM — Knowledge Sessions

Compliance & Risk	IT Audit	IT & Technology Leaders
KS1: The Access Review Is Dead: Why Ongoing Risk Assessment Is the Future of GRC Alexis Moyse, CEO & Co-Founder, Clarity Security	KS5: Vibe Code With Me: An Auditor’s First AI Agent — and the Honest Build-vs-Buy Reality Check That Comes Next Amanda Monrad, Head of Product, Kainos	KS1: The Access Review Is Dead: Why Ongoing Risk Assessment Is the Future of GRC Alexis Moyse, CEO & Co-Founder, Clarity Security
Why periodic, documentation-first GRC models are structurally insufficient for reducing risk in modern environments Why the NIST RMF model is no longer sufficient for modern risk environments and what a continuous, proactive approach looks like instead A four-step framework for reorienting your GRC program around real risk reduction with practical steps to execute in your first 30 days using tools you already have How to communicate the value of proactive risk management to business stakeholders using outcome-based language	A live build of an AI agent designed for audit use cases — no technical background required to follow along A vendor-neutral build-vs-buy framework grounded in the data-interconnectedness challenges that break most home-grown GRC agents The controls, transparency, and model-risk practices that separate a good demo from a defensible production agent Every attendee leaves with the agent spec, prompts, and guardrails to replicate the build in their own environment	Why periodic, documentation-first GRC models leave organizations exposed despite passing audits A four-step framework for shifting identity and access programs from compliance-driven to risk-driven Practical steps to execute that shift in the first 30 days using existing tools and without additional vendor investment

12:30–2:00 PM — Lunch, Networking & Exhibit Hall

The primary exhibit hall window of the day. Grab lunch and make your way through the floor. Come find Clarity Security at Booth 209 — we’d love to continue the conversation from the knowledge session.

2:00–3:00 PM — Concurrent Sessions

Compliance & Risk	IT Audit	IT & Technology Leaders
CS 2-5: Better Together: Practical Applications for GRC in the Era of AI Craig Unger, CEO & Founder, Hyperproof	CS 2-2: How to Design Internal Controls That Don’t Stifle Innovation Zach Rattner, CTO & Co-Founder, Yembo	CS 2-3: Human Centricity — The Forgotten Element of Mitigating Insider Risk Dr. Monté Ward, CIO, Prime Meridian Bank
How to spot the difference between unvetted AI automation and a structured, human-guided approach to GRC workflows A framework for determining which GRC tasks are best suited for AI tools versus human judgment How to calculate and improve the ROI of GRC spend by deploying AI where it actually counts How to design AI-assisted workflows that save your team time while remaining fully auditable for third-party regulators	How to design internal controls that support innovation rather than slow it down How to convert regulatory requirements like ISO 27001, SOC 2, and GDPR into practical, lightweight processes How to embed security and governance into everyday workflows rather than treating them as separate activities How to use automation to maintain audit readiness with minimal friction	How employee psychology and behavior create hidden security risks that technology controls alone can’t address Human-centric actions organizations can take to improve cyber hygiene and reduce insider threat exposure A practitioner perspective from banking on building programs that account for the human factors most frameworks overlook

3:00–3:15 PM — Quick Break

Just came out of CS 2-5? Stop by Booth 107 to continue the conversation with the Hyperproof team before the next session block.

3:15–4:15 PM — Concurrent Sessions

Compliance & Risk	IT Audit	IT & Technology Leaders
CS 3-5: AI, Cybersecurity, and the Future of GRC Peter Creal, Domain Expert Solution Advisor, SAP Erin Hughes, Global VP/Head of GRC, SAP	CS 3-3: Automated Tools in SOC 2 Reporting – Uses, Risks & Efficiencies Jeff Cook, Principal, Fortreum LLC Nick Norton, Partner, Geels Norton LLC	CS 3-6: The Database Blind Spot: Privilege, Audit, and Compliance Risk in the Data Layer Erik Brandsberg, CTO, Heimdall Data
How to modernize governance, cybersecurity, and assurance strategies for AI-enabled enterprises Practical approaches for establishing AI governance guardrails and strengthening cyber resilience How to evolve assurance programs to support trusted AI adoption at scale while improving accountability across business and technology teams	What automated GRC and SOC 2 tools actually do and how to use them effectively in an audit context The benefits and risks of relying on automated tools as part of the audit process Answers to the most common questions auditors have about incorporating automation into SOC 2 reporting	Why reported access often doesn’t equal effective access in relational database environments How runtime behaviors like ownership, inheritance, and session state create audit and SoD gaps that IAM exports miss What technology leaders need to evaluate to actually close the database-layer assurance gap

4:15–4:45 PM — Networking Break

Last exhibit hall window before the final session block. Good time to visit booths you didn’t get to at lunch — including Heimdall Data at Booth 308 and SAP at booth 307.

4:45–5:45 PM — Concurrent Sessions

Compliance & Risk	IT Audit	IT & Technology Leaders
CS 4-5: Building an AI Trust Governance Framework: Scaling GRC for the Age of AI Rahat Sethi, Sr. Director GRC, Adobe Ishitaa Patil, Sr. Manager GRC, Adobe Devansh Sharma, Manager GRC, Adobe	CS 4-4: WTF Is an MCP? And Why Auditors Should Care Richard Penfil, IT Audit Ops	CS 4-6: AI Is Making Your GRC Decisions. Can You Audit It? Alex Toews, Chief Product Officer, Mitratech
How Adobe governs AI systems across their full lifecycle for accountability, customer trust, and regulatory compliance A framework for ensuring AI deployments align with organizational values while supporting innovation at scale Practitioner-level content from an organization that has had to solve this problem at significant scale	What Model Context Protocol is and why it’s becoming critical infrastructure for AI-powered systems The security and governance risks MCPs introduce that most audit programs haven’t accounted for yet How to start incorporating MCP into your audit methodology before it becomes a finding	Why deploying AI for GRC decisions doesn’t automatically mean you can explain or defend those decisions What longitudinal traceability of AI decisions looks like and why regulators are starting to require it How to close the accountability gap before the EU AI Act, SEC disclosure requirements, and state-level frameworks force the issue

5:45–6:45 PM — Welcome Reception

The best unstructured networking opportunity of the conference. Come find the Clarity Security team — we’ll be there.

Tuesday, August 18

7:30–8:30 AM — Breakfast & Networking

Worth arriving on time. The second day tends to move faster than the first.

8:30–9:45 AM — Security Training Is Dead: An Intelligence Officer’s Playbook for Real Readiness
Maria-Kristina Hayden, Managing Partner, OUTFOXM

Hayden has worked as a Cyber Intelligence Officer and now runs OUTFOXM, her own cyber wargaming and advisory firm. The tradecraft once reserved for spies is now aimed at your workforce — phishing operations, social engineering, and lures that are nearly indistinguishable from legitimate interactions. She walks through how her definition of resilience allows organizations to take hits and keep operating. A strong anchor for the second day.

9:45–10:15 AM — Networking Break

Good window to visit booths you didn’t get to on Monday.

10:15–11:15 AM — Concurrent Sessions

Compliance & Risk	IT Audit	IT & Technology Leaders
CS 5-2: Define Your AI Strategy — Turn AI Ambition into Competitive Advantage Gokhan Polat, Founder, Clovera.io	CS 5-3: Seeing Is Deceiving: Deepfakes, Creative Power, and the New Trust Crisis Kyle Hinterberg, Senior Manager, LBMC Brian Willis, Partner, LBMC	CS 5-4: MCP Security Kanwal Mookhey, CEO & Founder, Network Intelligence
A strategic GRC framework that links governance, risk, and business priorities to execute AI strategy effectively How to assess AI readiness, align governance with business goals, and prioritize use cases Practical tools for compliance leaders who are being asked to be strategic partners rather than compliance enforcers	How deepfakes and synthetic media are creating new governance and audit obligations around identity and trust Real-world cases of identity cloning, voice replication, and digital impersonation and what they mean for audit programs How to identify, assess, and mitigate synthetic media risks before they become a compliance or reputational exposure	What security features MCP lacks and why that creates risk for organizations building on agentic AI infrastructure The most common security issues with MCP client and server implementations How to develop secure MCP clients and servers — practical guidance for technology teams building or evaluating agentic systems

11:30 AM–12:30 PM — Concurrent Sessions

Compliance & Risk	IT Audit	IT & Technology Leaders
CS 6-5: The Nth-Party Frontier: Managing the Risks You Can’t See David Raviv, Head of Partner Solutions, SecurityScorecard	CS 6-1: Anarchy in the Audit: The Punk Rebellion of GRC Engineering Jake Bernardes, CISO, Anecdotes	CS 6-2: Securing the Agentic AI Frontier: Executive Master Class Timothy Lee, Lead Principal, Coalfire
How to identify and map hidden fourth- and nth-party relationships that introduce systemic risk across your supply chain Contractual and operational strategies for gaining visibility beyond your direct vendor relationships How to detect and reduce vendor concentration risk using continuous, threat-informed intelligence Regulatory-aligned approaches for strengthening third-party risk programs against cascading supply chain disruptions	Why checkbox compliance has failed and what GRC Engineering looks like as the alternative How to apply AI, data pipelines, and Model Context Protocol to replace static audits with continuous assurance The principles of GRC Engineering and how to start building data-driven, automated audit programs New technical and career paths opening up for GRC professionals willing to move beyond traditional audit models	A strategic framework for responsibly deploying agentic AI systems across enterprise environments How to align autonomous AI deployment with cybersecurity requirements, compliance obligations, and business goals A 33-step blueprint for ensuring agentic AI operations are resilient, auditable, and future-proof What technology leaders need to know to make defensible decisions about autonomous AI at scale

12:30–1:45 PM — Lunch, Networking & Exhibit Hall

Primary exhibit hall window for Tuesday and the last full lunch break before the floor starts winding down. Stop by Booth 210 to continue the conversation with the Anecdotes team or Booth 208 to chat with SecurityScorecard.

1:45–2:45 PM — Concurrent Sessions

Compliance & Risk	IT Audit	IT & Technology Leaders
CS 7-3: Data Governance Redefined: Leading in the Cyber Era Rita Reynolds, Director Public Sector, CAI	CS 7-1: 90 Seconds to Midnight: A Model for Impactful Risk Communication Andrew Gunter, Partner, Cential Consulting Benny Akowuah, Manager Audit & GRC, American Transmission Company	CS 7-4: AI as an Accountable Entity: Governing Risk When Machines Make Decisions Pavithra Pradip, Staff Technical Compliance Manager, Intuit Christian Leitner, GRC Director, Intuit
How to redefine data governance frameworks to meet modern compliance demands in an AI-driven environment How to distinguish data from information governance and update retention policies accordingly How to build data-aware cultures that align governance with business resilience and compliance requirements	How to distill complex risk data into clear, engaging visuals and stories that drive stakeholder action Techniques for developing risk reports that resonate with leadership and create urgency without crying wolf Practical methods for auditors who have watched well-documented risk findings get ignored by the people who needed to act on them	How to classify AI systems as risk-bearing assets with defined lines of accountability How to design controls that ensure ethical, transparent, and auditable AI operations at scale What Intuit’s governance framework for autonomous AI decision-making looks like in practice

3:00–3:30 PM — Knowledge Sessions

Compliance & Risk	IT Audit	IT & Technology Leaders
KS10: Beyond Consent Banners: Building Continuous, Evidence-Based Compliance at the Digital Experience Layer Ivan Tsarynny, CEO & Co-Founder, Feroot Security	KS8: TPRM Is Dead Tomer Roizman, CTO & Co-Founder, Lema	KS7: Closing the Governance Gap: GRC Strategies for the Frontier AI Era Erin Hamm, Field Chief Data Officer, DataBeem
Why point-in-time privacy assessments fail to provide the continuous evidence regulators increasingly require How to shift to runtime verification that continuously discovers data flows and validates consent enforcement How to generate regulator-ready evidence across digital platforms for GDPR, CCPA/CPRA, HIPAA, and emerging frameworks	Why questionnaires and certifications are structurally incapable of catching the third-party risks that lead to real breaches How to validate vendor claims with outside-in evidence rather than self-reported compliance artifacts A practical framework for monitoring the access paths that actually matter and responding when something changes	Why AI governance gaps emerge when deployment outpaces governance and how to close them What AI-ready governance looks like in practice — continuous controls monitoring, unified data visibility, built-in lineage A 30-60-90 day roadmap for assessing your current state and operationalizing governance for AI

3:30–4:00 PM — Last Chance: Exhibit Hall

The exhibit hall closes at 4:00 PM. If there are booths you haven’t visited yet — including Clarity Security at Booth 209, Feeroot Security at Booth 113, or Lema at Booth 321 — this is your last window.

4:00–5:00 PM — Concurrent Sessions

Compliance & Risk	IT Audit	IT & Technology Leaders
CS 8-5: Governing AI Risk from the Inside Out Connor Snyder, GRC SME, Vanta	CS 8-3: Governing the Machine: Internal Audit in the Age of Mixed-Agent Ecosystems Nicole Jackson, Principal Consultant, Optimum Technology	CS 8-4: Encryption Endgame: Beating the Quantum Clock Jim West, Founder & CEO, TopCyberPro.com
First-party data on the scope of Shadow AI adoption and why it’s the fastest-growing blind spot in enterprise tech stacks Concrete steps compliance leaders can take to govern unmanaged AI adoption before it becomes a material risk How to build internal AI governance programs that keep pace with the speed of employee adoption	How to map oversight models for agentic AI systems including human-in-the-loop and human-on-the-loop How to align internal controls to NIST AI RMF, ISO 42001, and IEEE 7000 for autonomous systems What compliance readiness under the EU AI Act looks like for audit teams assessing AI-driven environments	How quantum computing will render current encryption obsolete and what the timeline looks like Quantum-resistant strategies including NSA’s CSfC and AES-256 that technology leaders need to understand now How to build layered post-quantum defenses before Q-Day arrives

Wednesday, August 19

No exhibit hall on the final day, but the session content is worth staying for.

8:15–9:15 AM — Concurrent Sessions

Compliance & Risk	IT Audit	IT & Technology Leaders
CS 9-1: Accelerate GRC Outcomes with AI — But Get the Basics Right Da’Veed Dildy, Director Technology Consulting, Protiviti Hermant Rungta, Director Technology Consulting, Protiviti	CS 9-6: ISACA, IIA, RIMS — Approaches to AI Control Andrew Guasp, Director of Standards & Professional Guidance, The IIA	CS 9-4: From Chaos to Clarity: Modernizing Cyber Risk with AI and Quantitative Frameworks Sridevi Rammohan, Staff Engineer Risk & Compliance, Instacart
How to reframe GRC as a digital journey starting with harmonizing people, process, and technology before introducing AI How to design integrated GRC architectures with governed taxonomies and trusted data as the foundation How to safely introduce agentic AI to automate risk content, accelerate rationalization, and deliver decision-ready insights Field-tested patterns including the GRC DataMart for improving reporting and reducing compliance effort	How the major standard-setting bodies are approaching AI governance, risk, and control Critical AI risk domains and how to audit based on them Where to access practical frameworks, standards, and professional guidance to support AI governance implementation	How to translate cyber risk into quantifiable business terms that resonate with executive leadership and boards Frameworks for aligning cyber risk scenarios with organizational goals and communicating them effectively How to build scalable risk workflows that keep pace with a dynamic threat environment

9:30–10:30 AM — Concurrent Sessions

Compliance & Risk	IT Audit	IT & Technology Leaders
CS 10-5: From Compliance Function to Strategic Advantage: Aligned Assurance in an Age of Disruption Matt Solomon, Managing Director GRC, Uniqus Nagaraj Uchil, Global GRC Leader, Uniqus	CS 10-1: Creative Compliance: Building a Stellar Function Without Losing Your Sanity (Or Your Sense of Humor) Julie Dotson-Shaffer Pearce, AMH	CS 10-4: Data Gathering Mastery: Channel Your Inner Sherlock Holmes (The LOCKS™ Model for Better Assessments) Doug Landoll, CEO, Lantego
How to position your assurance function as a strategic enabler rather than a compliance cost center A framework for aligned assurance where internal audit, ERM, and compliance work in concert The language to make the case for this shift to leadership — and why it matters more now than ever	How to build a compliance function that’s engaging, trusted, and effective without burning out the team running it Practical approaches to keeping the human element at the center of a function that can easily become transactional A fitting note for the final morning — a reminder that this work is as much about people as it is about policy	How to apply the LOCKS™ model — Lists, Observation, Curiosity, Knowledge, and Skills — to structure GRC assessment activities Techniques for strengthening observational and analytical interviewing to improve evidence gathering and control analysis How to recognize and mitigate bias during evidence interpretation to improve assessment accuracy Practical approaches for improving the clarity and impact of assessment reporting

10:45–11:45 AM — Closing General Session & Keynote
Jim Carroll, Global Futurist, Business Trends, Leadership & Innovation Expert

If the first two days have been heavy on the problems the profession is navigating, Carroll’s closing session is designed to reorient the conversation toward what’s possible. A strong note to end on and worth staying for.

---

Clarity Security is at ISACA GRC 2026. Come find us at Booth 209, we’d love to have a conversation.

View the full agenda for ISACA GRC 2026 here.