TLDR: Key takeaways from the 2026 ISC2 Congress
- A blanket "no" on AI often backfires. It pushes use to personal accounts and devices, where you can't see whether company data is being pasted into AI chats.
- Compile your AI inventory by first understanding the "need behind the need." Find out the use case behind each tool request and why existing options don't meet it.
- Insurers want evidence, not just a policy. Expect questions on which AI tools are in active use and how AI-related access is being governed.
- AI-written code is accelerating development but not security. A live leaderboard shows the best-performing agent-model combinations write functional code 87% of the time and secure code only 37% of the time.
- The rise in deepfakes and agentic AI is eroding trust signals. Trust and identity are increasingly being weaponized by attackers. Out-of-band checks and per-agent credentials should be standard practices in a modern workplace.
- Cyber insurers are shifting from policy reviews to governance. For your next renewal, expect questions about AI inventories, AI acceptable use policies, data exposure, and evidence of working controls.
- Lean teams need visibility before governance. Consolidating SaaS monitoring, shadow AI detection, and in-browser coaching can help close visibility gaps without adding operational complexity.
According to ISC2 CEO Scott Beale, we have days, not decades to act on the rapid changes we're facing. For many of you, AI adoption is moving faster than governance. And that tension was noted during the 2026 ISC2 Congress, which kicked off Oct 24-25, 2026, with hands-on, pre-event workshops on top-of-mind topics like AI governance and cyber leadership.
From Oct 26-28, I served as a volunteer chat moderator for virtual attendees, along with my fellow ISC2 peers. The enthusiasm and sense of camaraderie felt familiar, but the atmosphere was electric, somehow different from other Congresses I've attended.
The opening keynote began with insights from three incredible speakers: ISC2 CEO Scott Beale, Ethical hacker FC ("Freakyclown"), and his wife Dr. Jessica Barker (one of the UK's most influential women in cybersecurity). In the keynote, Scott emphasized: "These next thousand days are vital. We have a path forward, not just speculation and fear, to advance a shared vision of a more safe and secure cyber world." If you're responsible for AI governance and working with a lean team, the biggest lesson from ISC2 Security Congress 2026 was: Visibility matters, and governance can be simple enough to survive the realities of limited budgets. Below, I'm excited to share practical guidance on building an AI inventory, preparing for insurer scrutiny, and strengthening AI governance controls, all gleaned from the sessions I attended.
Why does a blanket "no" fail for shadow AI governance?
Because employees route around it. A ban on AI just moves the activity you don't want to personal accounts and devices, where your visibility clocks in at zero.
During the opening keynote, ethical hacker FC (yes, that's his real name) and his wife Dr. Jessica Barker, both co-founders of cybersecurity firm Cygenta, emphasized: When it comes to AI, it's better to "integrate and then secure it, rather than just saying no...because everyone will use AI, whether you want them to or not."
Dr. Barker cautioned that it's counter-productive to go "heavy on fear, without empowering positive behavioral changes and self-efficacy."
Fear-based messaging often drives denial and avoidance. Dr. Barker maintained that it's critical "we're proportionate in how we talk about the threat." And she made an important point: Unless people understand why the rule matters, they'll find a workaround.
FC described what that looks like in practice: Employees installing browser extensions just because they come from the Google or Apple Store. He shared how Microsoft recently found more than a million browser extensions hiding code that steals data.
In his session "Building AI Governance When no Playbook Exists: A Non-Profit CISO Story," speaker Marcus Peet, VP of Information Security at a national non-profit, put the same idea into operational terms: Shadow AI isn't "a discipline problem but a supply problem. If you haven't published an approved path, people will route around the absence of a decision.”
He acknowledged the challenges his audience faced, especially if they work with smaller teams. Peet shared the trajectory of AI governance at his organization (which resonated with many in the audience): “We have a small security team. Demand came first; the AI tools were in use before we had any governance in place.”
He then voiced a common frustration about this scenario: He read everything he could get his hands on about governance, from the NIST RMF to the EU AI Act. But they all described "outcomes," not "the mechanics" of how to actually get any AI governance in place.
And there's an even bigger problem before you can actually get that governance: You need to know what AI tools your team is using, and WHY they're using them. For many teams, the actual scale of that use is often hidden.
The 2026 LastPass State of AI & SaaS Security Report illustrates the challenge. According to the report, the top shadow AI tools employees routinely use are:
- ChatGPT (consumer) – 64%
- Claude (consumer) – 39%
- Gemini (consumer) – 36%
- Microsoft Copilot (personal/free tier) – 35%
Each of these percentages represents someone using AI for work tasks. But the listed tools are only the ones people admit to accessing. Which begs the question: How big is your shadow AI surface? Before you can offer a better path, you need to know not just which tools your team has chosen but WHY.
And to get to WHY, you need visibility.
So, how do you inventory shadow AI without a dedicated security team?
Start with actual logins, not just a list of approved tools on paper. You're looking for the ones your team signed up for on their own, without notifying IT.
To get an inventory, Marcus Peet advised starting with the tools you already have, noting that many SASE products already inspect traffic at the prompt, endpoint, and browser level. Still, he warned that the tooling market is split, with some products going wide on discovery and others going deep on prompt testing, so most teams end up combining tools.
|
That approach may provide coverage, but it introduces additional complexity and reporting silos. Rather than forcing you into an all-or-nothing approach, LastPass Business Max brings together SaaS discovery, shadow AI governance, and enterprise web filtering in a unified experience. Try it free for 14 days (no credit card required)
|
Peet's advice was to treat your AI inventory as a demand signal, not an enforcement list. Ask your team what the use case is for each one: "Understand the need behind the need."
Essentially, the goal of an inventory isn't simply to produce a list of apps. It's to understand which business problems your team is trying to solve and determine whether those needs can be met safely.
Peet's approval process for AI fits the constraints of a small team:
- Build the inventory around business needs. Ask what breaks if you say no. Peet uses this to assess how important the tool is and how likely people are to bypass a refusal.
- Create a standard intake form. For each tool, state why it's needed, why an existing tool won't do, and what the tool's residual risk is. His advice: "If you only build one of these, build the form."
- Give reviewers three things. A blank form, completion guide, and completed example. Peet found that a blank form alone produced inconsistent levels of rigor.
- Publish a runbook explaining the evaluation criteria and review process so reviewers can understand how a decision is made. Keep the process simple enough to work during the team's worst week, without requiring everyone to meet at once.
- Review the vendor, model, and data flow. Approval of a service doesn't automatically cover local installs, such as desktop clients, command-line tools, and browser plugins.
- Publish and explain the rationale for each decision to the requester. Use "conditional approval" for acceptable use. Peet said this represents most of his formal evaluations. When evidence or information is missing, use "deferral" but assign a named owner and date. Peet warned that an indefinite hold is a denial, and people will learn to read it that way.
But establishing an approval process is only part of the challenge. AI adoption often happens long before your security team can get to tool evaluations. Employees can sign up for browser-based AI apps in minutes, making it difficult to distinguish between approved and unapproved usage. That's why the browser has become one of the most important governance battlegrounds. It's where employees discover and adopt new AI tools, often outside your procurement process.
This lines up with what we found in our research, which we published in the 2026 LastPass State of AI & SaaS Security Report: The browser is where the gap is widest. If your inventory only covers apps behind SSO, it misses the majority of logins.
Now, visibility is only the first step. It can help you identify which AI tools your team is using, but it doesn't explain why they chose them. In many cases, adoption is driven by convenience and cost. People gravitate toward free or low-cost consumer AI tools that can be accessed immediately.
So, when enterprise-safe solutions are perceived to require extended approvals and consumer alternatives are available with just a few clicks, you need governance strategies that account for this reality. This is what LastPass Business Max addresses.
|
One dashboard to bring SaaS & AI use under control: Try LastPass Business Max free for 14 days (no credit card required) and gain visibility into SaaS, AI, and web activity from one place.
|
That said, visibility isn't just foundational for an accurate inventory, it's increasingly becoming an insurability requirement. Insurers want to know where AI is being used in your organization and how AI-related risks are being managed, which brings us to an important question.
What will cyber insurance underwriters ask about AI?
According to Sean Scranton (CISSP) and Jonathan Davies (CISO, CISSP), two cyber risk consultants from Willis Towers Watson, in their session "Your Next Insurance Renewal Is an AI Audit: What Do Underwriters Want?" you can expect three questions:
- Scope: How much and where is AI being used in your organization? This is where your inventory comes in, including unapproved tools and AI features in approved SaaS.
- Prudence: What due diligence was performed prior to its release? This is where Marcus Peet's intake form and approval flow helps.
- Compliance: How are regulatory considerations being weighed on an ongoing basis? For this, you'll need an AI acceptable use policy and regular reviews of it.
To this, I would add: How do I find out if employees are pasting sensitive data into AI tools? LastPass Business Max provides in-browser guidance at the moment of risk, when employees are about to enter sensitive data like API keys or credentials into an AI chat interface. You get a log of each warning to help enable crucial conversations around safe AI usage.
Currently, many policies haven't defined AI yet (Scranton and Davies called this "silent AI"). If your policy neither defines nor requires controls for AI usage, you're in a more favorable position. Both speakers said to "enjoy this for now."
Insurers are fast working on affirmative coverage that spells out what an AI loss looks like, so they can underwrite and charge appropriate premiums for it.
One thing both emphasized was: "Companies with sizeable AI exposure but poor governance may have terms negatively adjusted.”
Their advice for the interim was practical. Standard cyber insurance applications are mostly about demographics, information about your company. The ransomware supplemental asks about MFA, backups, and your controls; inaccurate answers here can affect a claim.
When asked about how to get ahead of AI risk for a lean team, Scranton and Davies recommended:
- Defining your risk appetite
- Breaking your AI use cases into quantifiable risk scenarios you can put a dollar amount against
- Getting your arms around AI acceptable use policies and shadow AI (take these "baby steps" first)
And even after you have a cyber insurance policy, they caution: Don't store your policy where attackers can access it. If they know you have $X million of limits of insurance and you have coverage for ransomware, that's what they'll ask for.
For a lean team, that means a list of the AI tools in use, an AI acceptable use policy, a named owner for each approval, and logs showing your controls work.
LastPass SaaS Monitoring surfaces the SaaS and AI apps your employees log in to daily, and LastPass AI Protect logs warnings when employees are about to paste sensitive info into AI, evidence you can present to your underwriter.
But AI governance doesn't stop at employee use of ChatGPT, Claude, or Gemini. As AI becomes embedded in dev workflows, there's another challenge: Ensuring AI-generated code doesn't introduce new security risks. This is where the focus shifts from prompts and data exposure to software vulnerabilities and supply chain risk.
Does AI-generated code need different controls?
It needs the same controls applied more often, due to the volume. In her session, "Is Your AI Code Assistant Generating Badly Behaving Code?" Lindsay Hughes of Carnegie Mellon's Software Engineering Institute said that functional code isn't equivalent to secure code.
She cited a live Endor Labs leaderboard in which the best agent and model pair wrote functional code 87% of the time and secure code only 37% of the time. She also cited Veracode research that 45% of LLM code samples introduced OWASP Top 10 vulnerabilities, and another study in which AI-assisted developers worked about four times faster but produced about ten times as many vulnerabilities.
In other words, AI can help you write more code, but not necessarily more secure code.
Interestingly, some of the risks Hughes described ultimately came back to the handling of sensitive credentials.
For example, "comment and control" attacks hide instructions in pull requests or comments and can trick coding agents into leaking repository secrets, API keys, and access tokens. Hughes said researchers observed this in Claude, Gemini, and GitHub Copilot workflows.
Hughes advised stretched teams to understand their ecosystem and risk appetite, identify what's mission critical, and lean on old-fashioned automation in CI/CD pipelines.
The broader lesson is that AI introduces new paths for sensitive info to leave your organization, whether through coding agents, dev workflows, or everyday use of AI tools. Organizations need layered controls that reduce risk before data is exposed. For safe, daily AI app use, LastPass AI Protect provides real-time coaching when users attempt to share credentials, API keys, or other sensitive info with AI apps.
What does access control look like when agents and deepfakes act like users?
Access control can no longer rely on the assumption that someone is who they claim to be. You need strong identity verification for both people and agents, unique credentials instead of shared accounts or keys, clear ownership of agent actions, and independent verification for high-risk requests.
During the opening keynote, Dr. Jessica Barker and FC ("Freakyclown") showed a live deepfake of Beale (with his face swapped for that of Prince William's). It was eerily accurate: The feed of Beale, with Prince William's face superimposed on him, moved and spoke normally, with no rendering glitches.
FC and Dr. Barker warned that the "old tells" for phishing, such as spelling errors and odd links, no longer hold. Attackers are now focused on manipulating trust, urgency, and authority.
What works in your favor is verification outside the channel. FC recommended a "duress" phrase, something from your personal life that you haven't shared online. Scranton and Davies said the days are gone when you can expect staff to spot a convincing deepfake; they recommended an out-of-band verification method that ensures attackers can't just call the help desk to get credentials reset. Meanwhile, Dr. Barker's rule of thumb was: "When your emotions spike, your skepticism should too."
Dr. Barker and FC mentioned how a LastPass employee's suspicions and critical thinking saved the day when a threat actor used a deepfake audio of LastPass CEO Karim Toubba to pressure them into taking a high-risk action.
Now, while deepfakes impersonate people, agents are a different problem with the same root: A login is no longer sufficient to prove an authorized person is acting.
During his session on "ISO/IEC 42001 and the Agentic AI Phenomenon: Human-in-the-Loop Governance That Actually Works," Larry Greenblatt (CISSP) criticized shared API keys and shared secrets: "Anything a human can do on a keyboard your agent can do. Why treat them differently?" He made the case for a certificate or credential for every agent, plus logs of which key was used, when, and by which agent. His agent record has three parts:
- Identity: Agent ID + responsible human
- Authority: Role + allowed actions
- Lifecycle: Model/policy version + credential expiration
One more thing from the session caught my attention. When asked who can authorize an agent's next action, a large portion of the audience said, "an approved policy." Greenblatt's reply was that a policy isn't a "who." He advised that when an action is consequential, such as disclosing data or changing access, a named owner must decide. Each approval should bind to an exact action and context and expire when either one changes.
In other words, permissions should be specific and short-lived: Log the request, decision, action, and outcome. That’s what insurers want to see as well.
The session on "Water, Water Everywhere, and Not a Drop Defended," shows how hard this gets for a small team. Phil Stupak, ISC2’s Senior Director of Advocacy and President Biden's Assistant National Cyber Director, shared that small utilities (population under 10,000) typically run with one to three technical staff, many consolidated roles, and the heavy use of contractors.
Consolidated roles make separation of duties harder, and every contractor represents another identity to verify. Stupak also noted that adversaries can sabotage industrial production without ever entering the country.
For the programmable logic controllers (PLCs) that run these systems, Stupak cautioned against connecting them directly to the open internet, and said air-gapping isn’t a panacea either. His recommendation: Good identity management plus encryption. Often, the simplest solutions are the most effective.
If you’re on a lean team, the following can help cover much of this:
- Name a human owner for every agent and automated workflow that has access.
- Retire shared keys and give each agent its own credential with an expiration date.
- Verify any urgent request to reset credentials or move money out of band, no matter who appears to be asking.
- Make approvals specific to one action and short-lived.
Each step depends on knowing what’s actually in use, which is again where visibility comes in.
Is LastPass Business Max a fit for my team and how does it enable shadow AI governance?
Business Max is a fit if four things are true:
- You have a small IT/security team or none.
- Your employees work in the browser, with a mix of approved and self-adopted apps.
- You know people are experimenting with AI, but you don't have an easy way to see which ones are entering your environment. As a result, you can't establish clear policies and accountability for agent usage.
- You need to show an auditor, insurer, or customer evidence of controls that protect access.
This is where the order of operations matters. You can't govern what you can't see, so visibility comes first. The path is simple: Gain visibility, establish controls, and coach employees at the moment of risk.
- LastPass SaaS Monitoring discovers the SaaS and AI apps your employees log in to, including the ones nobody approved.
- LastPass SaaS Protect lets you act on that with "Allow," "Warn," or "Block" rules by app.
- LastPass AI Protect reinforces the above guardrails with in-browser coaching for AI tools like ChatGPT, Microsoft Copilot, Claude, and Google Gemini. Employees see a warning as they are about to paste credentials, API keys, or sensitive info into a prompt, or when they try to upload files to unapproved AI platforms. Every warning is logged in your admin User Activity, which is evidence you can present to your auditor or underwriter.
Best of all, these capabilities run through the LastPass browser extension. There are no agents, DNS changes, or proxy to set up. For resource-constrained teams, that means faster deployment, lower admin overhead, and fast visibility into AI adoption. To see which AI tools your team is already using and help them make safer decisions in real time, start a free Business Max trial now (no credit card required).
FAQ: 2026 ISC2 Congress
Does implementing LastPass Business Max count as employee surveillance?
Any security control that detects risky actions can raise questions about surveillance. The key distinction is intent and outcome.
Business Max provides capabilities such as SaaS, AI, and Web Monitoring to surface the SaaS and AI apps your employees log in to and the web categories they browse.
Meanwhile, AI Protect serves as an in-browser coaching and self-awareness tool: Employees see a prompt when detected sensitive data is headed into an AI tool. On the admin side, you'll see each warning in the User Activity list. This just-in-time coaching allows your employees to continue working while learning safer practices.
So, what AI Protect does is provide context at the moment of risk to guide safer behavior. This aligns with Dr. Jessica Barker's point that fear without a path to safe behavior often backfires.
LastPass provides that safe path.
Business Max capabilities aren't designed to monitor employee productivity, evaluate their performance, track time spent working, or determine what employees are doing throughout the day. They were built to safeguard corporate data, while helping your employees comply with your AI acceptable use policy with as little friction as possible.
Could employee education and policy reminders be effective alternatives to a ban on AI?
Awareness training and policy reminders work best alongside technical controls, not instead of them. Marcus Peet made the point that shadow AI is a supply problem, not a discipline one, which highlights why reminders alone fall short: If people have no approved tool that meets their needs, they'll find their own.
With LastPass SaaS Protect, you can apply tiered controls for access: "Allow" for approved tools, "Warn" for medium-risk tools, and "Block" for the highest-risk apps. The Allow/Warn/Block model lets you match the response to the risk.
After detecting unauthorized AI use, how should security, HR, and management respond?
Start with curiosity, not discipline. Treat the finding as a demand signal, as Peet framed it, and "ask what the need behind the need is."
- The security team investigates and identifies what data AI tools can touch and whether each use is acceptable.
- Management decides whether the business need justifies specific tools, and each approval gets an owner and expiration date.
- HR gets involved when usage means non-compliance with company policy or involves the use of proprietary data.
It's important to record the rationale for each decision. Insurers, as Davies and Scranton emphasize, want to see evidence of governance, not just a policy.
Is human review a bottleneck for AI agents, and can another AI replace it?
Greenblatt admitted that he doesn't think an AI can ever take a human's place in the review loop, but you can add a layer of oversight. In his lab, first-line agents do the initial work, second-line agents provide oversight, and a human does the final review. He has run as many as 47 agents and said he can't watch all of them, so he also checks one model's work against another's. This was a personal lab setup, however, not a model he recommends for business use.
Do AI providers really delete your chat history?
Greenblatt said he doesn't trust that data is ever truly deleted, and he keeps personal and customer data out of AI tools for that reason. So, treat anything pasted into a consumer chatbot as something that may persist, and check each provider's terms. To protect your business, LastPass AI Protect shows employees a warning before they submit detected sensitive data, such as a password or API key, to an AI chatbot.
How common are deepfakes, and what is hybrid phishing?
In the opening keynote, FC and Dr. Barker said email is still the main attack vector, and that attackers increasingly combine channels, like an email followed by a voice call, which they call "hybrid phishing." Voice cloning, they noted, is also a favorite tactic. The practical takeaway is to verify requests through a channel the attacker doesn't control.
Do duress phrases work, and isn't it rude to challenge someone?
FC recommended agreeing on a phrase or question, something from your personal life that isn't online, to confirm identities when a request feels off. Dr. Barker recommended that leadership take the initiative to cultivate a culture of inquiry and sharing near misses. This makes verification a normal practice. Ultimately, you'll want to pair an agreed-upon phrase with a rule that any urgent request to move money or reset credentials gets verified out of band, no matter who appears to be asking.
How do you build critical thinking when AI detectors can't be relied on?
Dr. Barker's advice was to name your emotions at the point of decision: "Name it to tame it." When your emotions spike, such as urgency, fear, or frustration, that's the moment to trust your skepticism as a valid reaction. She also said overconfidence is common, even among technical people, so run tabletop exercises that let staff practice a convincing fake request before they meet a real one.
Do I need to install new agents or change my network for LastPass Business Max to work?
No. All Business Max capabilities like AI Protect and Web Protect run through the LastPass browser extension already on employee devices. There are no new agents, DNS changes, or proxies to set up.
