8:30-9am: Badge Pickup & Coffee

​

9am-12pm: AI Contract Risk: What Security Professionals Need to Know

Presented by: Jonathan Kimmitt (Alias Cybersecurity, CISO)

 

AI is quickly becoming part of the products and services organizations use every day. This course helps security professionals understand what to look for in contracts when their organization uses AI or when a vendor uses AI to provide services.

The course focuses on practical contract review: what questions to ask, what language should raise concerns, and when security professionals should involve legal, privacy, or other stakeholders.

Key Points:

• Identifying AI use by vendors and service providers

• Understanding what data may be shared with AI systems

• Determining whether organizational data can be used to train or improve AI models

• Reviewing data ownership, retention, and deletion requirements

• Understanding AI subprocessors and third-party providers

• Reviewing security and breach-notification requirements

• Identifying confidentiality and intellectual-property concerns

• Addressing vendors that add AI capabilities after a contract is signed

• Understanding AI opt-in and opt-out provisions

• Identifying concerning language in contracts, Terms of Service, and privacy policies

• Knowing what questions security professionals should ask during vendor reviews

• Knowing when an AI contract issue should be escalated to legal or privacy teams

​

12-1pm: Security Workshop Lunch

​

1-4pm: AI Incident Response: Tabletop Exercise

Presented by: Jonathan Kimmitt (Alias Cybersecurity, CISO)

 

This interactive tabletop exercise places participants in a realistic incident involving the use of AI. Participants will work through decisions involving sensitive data, employee and third-party AI use, security and privacy concerns, and incident response.

The exercise will examine how cybersecurity, legal, privacy, leadership, contract management, and vendor management work together during an AI-related incident. Participants will consider vendor responsibilities, contractual requirements, notification obligations, investigation, communications, and the actions necessary to manage and recover from the incident.