Conference Description
Key Takeaways
- Enterprise cybersecurity and risk management conference for senior security leaders including CISOs, security managers and risk executives
- Core themes span AI security, zero trust architecture, cloud security, cyber resilience and third-party risk management
- Addresses regulatory compliance challenges, supply chain vulnerabilities and the operational integration of emerging technologies
- Features analyst-led sessions, executive programmes, peer networking and access to more than sixty solution providers
- Takes place July 22–24, 2026 at Grand Nikko Tokyo Daiba in Tokyo, Japan
Introduction
The Gartner Security & Risk Management Summit 2026 returns to Tokyo as one of the Asia-Pacific region’s most significant gatherings for enterprise security professionals. Scheduled for July 22–24, 2026, the three-day conference brings together CISOs, security architects, risk management leaders and data protection officers to examine the strategic and technical challenges shaping modern cybersecurity programmes. With artificial intelligence reshaping both defensive capabilities and threat landscapes, and regulatory frameworks tightening across jurisdictions, the summit arrives at a moment when security leaders face mounting pressure to demonstrate measurable resilience while enabling business innovation.
About This Event
Hosted at Grand Nikko Tokyo Daiba, the summit combines analyst-led presentations with interactive workshops, executive roundtables and structured networking opportunities. Gartner positions the event as a platform for validating security strategies against independent research and peer experience rather than vendor marketing. The programme includes dedicated tracks for different security disciplines, allowing attendees to focus on infrastructure protection, application security, security operations or executive leadership depending on their responsibilities.
A notable feature is the CISO-exclusive programme, which provides senior executives with focused sessions on organisational resilience, board-level communication and long-term security roadmaps. These closed-door discussions acknowledge that security leadership increasingly requires business acumen alongside technical expertise. Participants can also schedule individual consultations with Gartner analysts to address organisation-specific challenges.
Artificial Intelligence and the Evolving Threat Landscape
AI security emerges as a central theme throughout the programme, reflecting the dual nature of artificial intelligence as both an enabler and a risk vector. Security teams are grappling with how to protect AI systems themselves—including large language models and autonomous agents—while simultaneously leveraging AI to enhance threat detection and response capabilities. The summit addresses practical concerns around AI agent risks, examining how organisations can govern automated systems that make decisions with limited human oversight.
This focus responds to genuine operational challenges. As enterprises deploy AI across customer service, software development and business process automation, security teams must establish guardrails without impeding the productivity gains these technologies promise. The intersection of AI governance and traditional security controls represents relatively uncharted territory for many organisations, making peer insights particularly valuable.
Cloud Security and Zero Trust Implementation
Infrastructure and cloud security sessions address the complexities of hybrid environments where workloads span on-premises data centres, multiple public cloud providers and edge computing nodes. Zero trust architecture continues to dominate strategic discussions, though the summit moves beyond conceptual frameworks to examine implementation realities. Many organisations have discovered that zero trust principles are easier to articulate than to operationalise, particularly when legacy systems and third-party integrations complicate identity verification and access control.
The programme explores how security mesh architectures can provide consistent policy enforcement across distributed environments. This approach acknowledges that perimeter-based security models have become inadequate as corporate networks dissolve into interconnected services and remote access points. For security leaders managing multi-cloud deployments, understanding how to maintain visibility and control without creating operational friction remains a persistent challenge.
Third-Party Risk and Supply Chain Vulnerabilities
Supply chain security has moved from a compliance checkbox to a board-level concern following high-profile incidents that demonstrated how attackers can compromise trusted software providers to reach downstream targets. The summit dedicates significant attention to third-party risk management, examining how organisations can assess vendor security postures, establish contractual protections and monitor ongoing relationships without creating unsustainable administrative burdens.
This challenge intensifies as enterprises rely on increasingly complex ecosystems of software-as-a-service providers, managed service partners and open-source components. Traditional questionnaire-based assessments often fail to capture dynamic risk, prompting interest in continuous monitoring approaches and standardised security attestations. The regulatory environment adds urgency, with authorities in multiple jurisdictions introducing requirements for supply chain due diligence.
Security Operations and Incident Response
Sessions on security operations centre modernisation address the tension between expanding attack surfaces and constrained security budgets. Security information and event management platforms continue to evolve, incorporating machine learning for anomaly detection and automated response orchestration. However, many organisations struggle with alert fatigue, tool sprawl and the difficulty of recruiting skilled analysts in a competitive labour market.
Exposure management represents an emerging discipline that attempts to shift security operations from reactive incident response toward proactive risk reduction. By continuously assessing which vulnerabilities and misconfigurations pose the greatest actual threat—rather than relying solely on severity scores—security teams can prioritise remediation efforts more effectively. The summit examines how this approach integrates with existing vulnerability management programmes and threat intelligence feeds.
Regulatory Compliance and Data Protection
Privacy and data protection officers attending the summit face an increasingly fragmented regulatory landscape. Requirements vary significantly across jurisdictions, and organisations operating internationally must navigate overlapping obligations while maintaining operational efficiency. The programme addresses how security and privacy functions can collaborate more effectively, recognising that technical controls and governance frameworks must work in concert.
Operational technology security also features prominently, reflecting growing concern about cyber-physical systems in manufacturing, utilities and critical infrastructure. These environments present unique challenges because legacy industrial control systems were often designed without security considerations and cannot easily accommodate modern protective measures. As IT and OT networks converge, security leaders must develop strategies that address both domains.
Who Should Attend
The summit targets senior security professionals responsible for strategic direction and programme execution. This includes chief information security officers, security architects, risk management leaders, identity and access management specialists, business continuity planners and data protection officers. The content assumes familiarity with enterprise security concepts and focuses on leadership challenges rather than introductory technical training.
Organisations with advanced security requirements—particularly those in regulated industries, critical infrastructure sectors or with significant cloud adoption—will find the programme most relevant. The networking opportunities provide particular value for leaders seeking to benchmark their approaches against peers facing similar challenges.
Solution Provider Engagement
More than sixty solution providers participate in the exhibitor showcase, offering attendees exposure to technologies spanning endpoint protection, identity governance, cloud security posture management and security analytics. While the summit maintains an educational focus, the exhibition provides opportunities to evaluate emerging capabilities and engage with vendors outside the typical sales cycle. Continuing professional education credits are available for qualifying sessions, supporting ongoing certification requirements.