Where is the Gartner Security & Risk Management Summit taking place?

The summit is scheduled to be held in Mumbai, IND.

What is the primary focus of this event?

The event focuses on cybersecurity and risk management, providing insights into navigating digital threats and regulatory environments.

When does the conference take place?

The conference is scheduled for two days in March.

Gartner Security & Risk Management Summit 2027

Name: Gartner Security & Risk Management Summit 2027
Start: 2027-03-08T00:00:00Z
End: 2027-03-09T00:00:00Z
Location: Mumbai

Mar 8–9, 2027Mumbai, IndiaIn-person

Registration open

The Gartner Security & Risk Management Summit is an annual conference focusing on the evolving landscape of cybersecurity and risk management. Held in Mumbai, IND, this event brings together industry leaders, practitioners, and technology providers to discuss strategies for navigating complex digital threats and regulatory environments. The summit offers insights into emerging technologies, best practices, and innovative solutions for safeguarding organizational assets and ensuring business resilience.

Committees & topics

Topics
Artificial Intelligence in Cybersecurity · Cloud Security · Data Security and Governance

Why it matters

In an era of escalating cyber threats and increasingly stringent data protection regulations, effective security and risk management are paramount for organizations globally. This summit provides a critical platform for professionals to enhance their understanding of these challenges, share experiences, and learn about cutting-edge approaches. The focus on the Asia-Pacific region, particularly with the event's location in Mumbai, IND, highlights the unique security challenges and opportunities present in this dynamic economic zone. As digital transformation accelerates across industries, the ability to proactively identify, assess, and mitigate risks becomes a key differentiator for sustainable growth and competitive advantage.

The discussions and presentations at the summit are designed to equip attendees with actionable intelligence to strengthen their security postures. This includes addressing topics such as cloud security, artificial intelligence in cybersecurity, incident response, and compliance with data privacy frameworks. The insights gained can directly inform strategic decision-making, helping organizations to not only protect against threats but also to leverage security as an enabler for innovation and trust. The collaborative environment fosters networking and knowledge exchange, which are vital for building a resilient global cybersecurity community.

How to prepare

Delegates preparing for the Gartner Security & Risk Management Summit should focus on understanding the current global cybersecurity threat landscape, with particular attention to trends impacting the Asia-Pacific region. Familiarity with key concepts in cybersecurity governance and data governance will be beneficial. Reviewing recent developments in data localization policies and the Digital Personal Data Protection Act, 2023, relevant to IND, will provide a strong foundation for engaging with discussions.

To maximize the learning experience, attendees should consider which sessions align with their organization's specific security challenges and strategic objectives. Engaging with the content through the lens of 'dynamic analysis' can help in critically evaluating proposed solutions and frameworks. Furthermore, understanding 'hidden stakeholders' in cybersecurity initiatives and developing 'engagement strategies' for different organizational levels will be crucial for implementing new insights effectively back in their respective organizations. Preparing specific questions related to their own operational contexts will facilitate more targeted learning and networking opportunities.

Country perspectives

Where the most-relevant 3 countries stand on the core issues in play. Click through for the full country profile.

India

A key player in the global digital economy, facing significant cybersecurity challenges due to rapid digitalization and a large attack surface.

Role in topic

As the host nation, IND is a focal point for discussions on cybersecurity regulations like the Digital Personal Data Protection Act, 2023, and the challenges of securing critical infrastructure and a vast digital user base. Its burgeoning tech sector also positions it as a source of innovation in cybersecurity solutions.

United States

A global leader in cybersecurity innovation and policy, often setting benchmarks for industry standards and best practices.

Role in topic

Organizations from the USA frequently contribute to and influence global cybersecurity discourse, bringing expertise in areas like advanced threat detection, incident response, and regulatory compliance. Their perspective often emphasizes technological solutions and international cooperation.

China

A major economic and technological power with a unique approach to cybersecurity, emphasizing national security and data sovereignty.

Role in topic

CHN's cybersecurity policies, including stringent data localization policies, present both challenges and opportunities for global businesses. Its rapid technological advancements also mean it is a significant contributor to both cyber threats and defensive capabilities.

Topics & background

The background behind each topic and the actors that shape it.

Artificial Intelligence in Cybersecurity

The integration of artificial intelligence into cybersecurity has accelerated sharply since the mid-2010s, when machine learning began to outperform signature-based tools at anomaly detection, malware classification, and user-behavior analytics. The rise of generative AI from 2022 onward broadened the field considerably: defenders gained tools for automated triage, code review, and natural-language threat intelligence, while attackers gained equally powerful capabilities for spear-phishing at scale, deepfake-enabled fraud, and rapid exploit development. National cybersecurity agencies, including CISA in the United States, the UK's NCSC, and ENISA in the European Union, have issued joint guidance on secure-by-design AI systems, while the EU AI Act (entering force in 2024) and the US Executive Order 14110 (2023) established the first broad regulatory frameworks touching AI security. The core dispute is twofold. First, how should organizations balance the offensive uplift AI gives adversaries against the defensive uplift it gives security operations centers, given that both sides are improving simultaneously? Second, how should governments regulate dual-use models, model weights, and training data without stifling the very defensive research the ecosystem depends on? Standards bodies such as NIST (AI Risk Management Framework, 2023) and ISO/IEC (the 42001 series) have begun codifying controls, but enforcement and cross-border harmonization remain unsettled. Today the conversation is shifting from pilots to operational reality: securing the AI supply chain (model provenance, data poisoning, prompt injection), governing autonomous agents that take actions on enterprise systems, and quantifying AI-specific risk in board-level terms. Major incidents involving AI-assisted social engineering and model exfiltration have made clear that AI in cybersecurity is no longer an emerging topic but a present operational concern.

Key players

Cloud Security

Cloud computing's rapid consolidation around a handful of hyperscale providers — Amazon Web Services, Microsoft Azure, Google Cloud, and, regionally, Alibaba Cloud and others — has reshaped the enterprise attack surface over the past fifteen years. The shared-responsibility model, formalized in the early 2010s, drew a line between provider-managed infrastructure security and customer-managed configuration and identity. In practice that line has been a persistent source of breaches: misconfigured storage buckets, over-privileged identities, exposed APIs, and compromised SaaS tenants have produced some of the largest incidents on record, including the 2023 Storm-0558 intrusion into Microsoft cloud email and a string of identity-provider compromises affecting downstream customers. The core disputes are jurisdictional and architectural. Governments increasingly demand data sovereignty, sovereign cloud offerings, and lawful-access guarantees, exemplified by France's SecNumCloud, Germany's C5, the EU's evolving EUCS scheme, and the US FedRAMP program. At the same time, customers face tension between consolidating on a single hyperscaler for security simplicity and diversifying to avoid concentration risk and vendor lock-in. Standards work — CSA's Cloud Controls Matrix, ISO/IEC 27017/27018, and NIST SP 800-204 series — has matured, but multi-cloud and SaaS sprawl have outpaced governance. Today the field is dominated by identity-first security (CIEM, ITDR), workload protection across containers and serverless, and the consolidation of CSPM, CWPP, and DSPM into broader CNAPP platforms. Regulators in the EU (DORA, NIS2) and the US (SEC cyber disclosure rules, proposed CIRCIA reporting) are sharpening expectations around cloud resilience and incident transparency, while the geopolitics of cloud — including export controls on advanced compute — increasingly intersect with security policy.

Key players

Data Security and Governance

Data security and governance emerged as a distinct discipline as organizations realized that perimeter and endpoint controls alone could not protect information that flowed across SaaS, partners, and analytics platforms. The 2018 enforcement of the EU's General Data Protection Regulation set a global template, followed by the California Consumer Privacy Act (2020), Brazil's LGPD, India's Digital Personal Data Protection Act (2023), and China's tightly integrated PIPL, DSL, and Cybersecurity Law regime. These frameworks combined privacy obligations with security duties — encryption, breach notification, cross-border transfer controls — and effectively forced data inventory and classification onto the executive agenda. The central disputes today are about scope and sovereignty. Cross-border data transfers remain contested: the EU-US Data Privacy Framework (2023) replaced the invalidated Privacy Shield but faces continued legal challenge, while China's data export rules and Russia's localization regime fragment the global data fabric. Inside organizations, the explosion of unstructured data, the use of enterprise data to train AI models, and the rise of data lakes and lakehouses have outpaced traditional DLP. New categories — Data Security Posture Management (DSPM), Data Detection and Response (DDR), and AI-aware data governance — are attempting to give security teams visibility into where sensitive data lives, who can access it, and how it is being used by both humans and models. The contemporary agenda centers on reconciling security, privacy, AI governance, and business value. Boards face mounting disclosure obligations (SEC rules in the US, NIS2 and DORA in the EU), while CISOs and Chief Data Officers negotiate ownership of policy, tooling, and risk. The unresolved question is whether data governance will consolidate under a unified control plane or remain a patchwork stitched across privacy, security, and AI functions.

Key players