By Jack Welling
During my time with Idenhaus, we’ve dedicated ourselves to talking with organizations about who has access to what, whether they can prove it, and what happens when the answer is "we're not sure." It’s a good vantage point, but it is a narrow one. You hear the same five problems described in fifty different ways, and after a while you start to wonder whether you are seeing the whole industry or only the slice of it that already knows it has a problem.
So I went to ISACA Chicago's Conference+ event to be in a room full of leaders at the forefront of the current challenges in Identity, AI, and Governance.
Two reasons.
The first was knowledge. Idenhaus works across IAM, IGA, PAM, CMMC readiness, and FedRAMP support, and AI adoption and faster-moving regulation are reshaping every one of those areas right now.
So I wanted to hear what current practitioners had to say about those pressures in their own words, not filtered through a vendor deck or a LinkedIn thread.
The second was networking. I’ve come to learn that Chicago has a real security community, and a meaningful part of my job is knowing who is in it. To understand which problems keep people up at night, and where we can help when those problems become urgent.
I came across the ISACA Chicago Chapter while mapping out Chicago-area cybersecurity communities focused on the issues and challenges surrounding identity security. After learning that our CEO, Hanno Ekdahl, had presented for his own ISACA chapter in Atlanta, I decided to find mine. What stood out about this chapter was the audience mix. ISACA sits at the intersection of audit, risk, governance, and security, which means the room is not just practitioners; it's the risk and audit leaders who have to justify security spend to a board.
That mix turned out to be the whole point.
ISACA Chicago Conference+ 2026 ran on August 27 in Chicago under the theme "The Trust Imperative: Securing What's Next." Two tracks, a keynote, a CISO panel, and a closing session, all in a single day, with hallway conversations that were worth about as much as the agenda itself.
The opening keynote came from Bjorn R. Watne, Global CISO at INTERPOL, on succeeding with security at scale. He framed the tension that every later session ended up circling: attack surfaces have expanded dramatically, lower-skill attackers now have AI-driven leverage they never had before, and the response window on new vulnerabilities has effectively gone negative. Defenders are reacting to things that are already in motion. His conclusion was not that anyone needs a bigger budget. It was that no single organization can defend against nation-state reconnaissance alone, and that speed and cross-border collaboration have replaced headcount as the differentiator.
Track 2 opened with Pierluigi Sartori of GOSP on cyber resilience as a fiduciary duty. This was the session I did not expect to be my favorite. Sartori argued that board reporting is fundamentally a translation problem. Boards understand risk and money. They do not understand a list of unpatched CVEs. His example: 14 critical CVEs against two unmitigated vulnerabilities can be expressed as a quantified annual loss-exposure figure, and once you do that, the conversation shifts from "why do you need this" to "what does it cost to fix." He also walked through where the CISO role is heading, from technical guardian to business risk manager reporting into both the CRO and the CEO, and flagged DORA's third-party ICT risk requirements as a likely template for SEC rulemaking within roughly the next two years.
Pam Nigro of Medecision drew the line between AI governance and AI assurance, which I think is the most useful distinction I brought home from the day. More on that in the next post.
Ulrika Dellrud of Smarter Contracts covered privacy in the age of AI, with a framing I have already reused twice: security builds the walls, privacy defines the rules behind those walls, and the two functions have to operate jointly. Her core thesis was that AI does not need to be hacked to cause harm. It can operate exactly as designed and still produce an outcome nobody would accept.
Brian Albertson of State Farm talked through GRC operating models in a session on moving from control chaos to control clarity. His point was that most control pain is not a controls problem; it’s an operating-model problem, compounded by audit fatigue and conflicting state laws. His line about governance stuck with me: done well, nobody notices.
The CISO panel looked back a decade. A shortfall of roughly 10 million cybersecurity jobs was projected back then; today the estimate is closer to 500,000 open roles, which is a real narrowing. Governance and security used to sit far apart organizationally and have since converged. Change cycles that took 18 months now happen overnight. And boards, the panel said, care about exactly three things: make money, save money, stay out of jail.
The line that got the biggest reaction from me personally: CMMC was dismissed as a joke a decade ago and is now taken seriously, with control counts growing from roughly 17 to 110 over that span. I spend much of my week in CMMC conversations with defense industrial base companies. Hearing a panel of CISOs describe that shift from the inside was a useful reminder that compliance frameworks people currently roll their eyes at tend to become table stakes.
Katie Arrington, CIO at IonQ, closed out the conference day. Drawing on her experience as a former government CIO, she argued that quantum is the next frontier after AI. Her specific point: quantum key distribution isn't deployed at scale in the U.S. today, and organizations should focus on post-quantum cryptography readiness now, not later.
Three things.
One: identity is still the unsolved problem; it just has a new set of subjects. Multiple sessions landed on the same place. Roughly 90% of breaches once traced back to cloud misconfiguration, and the fix was data and identity management. Today the conversation is about AI agents holding excessive access rights. Same failure mode, new principal. Configuration and identity remain the problem, as the CISO panel put it.
Two: the hard part is translation, not technology. Sartori on board reporting, Albertson on operating models, and the CISO panel on what boards understand were all describing the same gap. The organizations that struggle are not the ones with worse tooling. They are the ones that cannot explain their risk in a language the people holding the budget actually speak.
Three: showing up is underrated. I went in expecting to learn about AI risk. I came out with a much clearer picture of how audit, risk, and security leaders in this city talk to each other, what they are being asked for, and where they feel unsupported. Although they work for different organizations, operate in different states, and sit across international borders.
ISACA chapters are active in cities around the world, and the value of a local one is hard to overstate: the information, the community, and the reminder that the problems you are wrestling with are not unique to you. If you have not attended an event in your area, it is worth your time. And if you were at Conference+ in Chicago, or you are working through any of this at your own organization, I would like to hear about it.
