For most mature organizations, traditional security controls are no longer the hard part. Detection engineering, hardening, identity, cloud security, compliance, even many forms of threat hunting have become table stakes. But in an AI-dominant world, the most consequential threats increasingly emerge outside the boundaries those programs were designed to defend.

This keynote asks a more basic question: do you actually know your assets, your risks, and your boundaries? Trust underpins all three, yet most security programs still treat trust as static and well understood. AI increases speed, scale, and ambiguity, making it harder to continuously validate who belongs inside the organization, which outside relationships create exposure, and where the company’s real operational edges actually are. Most security programs are still control-led rather than threat-led: they begin with tools, telemetry, and detections instead of a clear understanding of how adversaries will exploit the seams between people, third parties, and institutional boundaries. Before you can detect or disrupt a threat, you have to know where it is most likely to form.

The central challenge for security leaders is no longer just building stronger controls. It is learning to see earlier, wider, and more clearly. This talk argues for a threat-led approach to security in which identification comes first: understanding how threat behavior is changing, where conventional programs have blind spots, and how to illuminate the hidden surfaces where the next generation of risk is already forming. In an environment shaped by AI, better security will belong to organizations that can turn threat identification into sharper judgment, faster orientation, and more decisive action before the fog closes in.