Breakout roster

The goal: move faster, safer, and more predictably by combining Tanium Atlas, AI, and automation. In two months, one developer saved over 500 hours across analysis, investigation, and programming work. Atlas extends the team's capabilities by migrating playbooks and scheduled actions when someone leaves the organization, searching for sensor or package usage across scheduled actions and playbooks to assess the impact of changes before making them, and answering detailed questions about Tanium's API access and functionality. The takeaway: Atlas doesn't just support the team's Tanium usage — it multiplies it.

Vulnerability remediation was slow, aged vulnerabilities were high, and SCCM-based patching was unreliable, with long maintenance windows that frequently didn't complete. The team rebuilt patch scheduling from the ground up in Tanium, covering both OS patching and third-party updates, then integrated with ServiceNow. The result: a 92% drop in aged vulnerabilities and mean time to patch down from 45+ days to under 15 — a measurable improvement to the organization's security risk posture.

Legacy patching relied on fragmented tools and manual staging, with 1–2 week cycles per patch window across a complex, multi-OS server fleet while masking unmanaged endpoints and configuration drift behind narrow compliance reporting. The team built an autonomous 5-day patching pipeline using Tanium Atlas and Tanium Patch- Atlas dynamically tags server groups across Windows, Linux, Solaris, and AIX plus cloud and virtual footprints (VMware, Azure, AWS, OpenStack), then orchestrates staged deployment rings that validate stability before cascading further, fully automating Windows Server Patch Tuesday cycles. In head-to-head testing, Tanium hit 97% patch compliance with zero failed servers versus SCCM's 85% (16 failures), and single-pane visibility surfaced hidden drift - including 16 browser versions and unmanaged remote-access tools - that legacy tools missed. One CVE was remediated across 172 endpoints in two weeks via configuration changes alone. Next: extending autonomous patching to 100% of production and multi-cloud environments.

IT Ops regularly needs to isolate endpoints posing critical risk — severe vulnerabilities, unpatched systems beyond remediation, theft, or loss — with isolated devices then requiring physical shipment or direct technician follow-up. Tanium's quarantine capability was the natural mechanism to enforce isolation, but on peak days hundreds of devices can need quarantining at once, making manual handling impractical and error-prone. The team is automating the quarantine workflow so it scales reliably without sacrificing response time or accuracy.

The airport environment was never designed as a single, unified technology ecosystem, and the evolving threat landscape, growing reliance on interconnected systems, and rapid rise in connected devices have made that gap impossible to ignore. Having already used Tanium to build a more current and actionable view of its IT environment, the team is now extending that same visibility and context into Operational Technology — identifying not just an IP address, but what a device does, who owns it, what it talks to, and the impact if it's compromised. Next: one unified view spanning both IT and OT.

Supporting more than 110,000 endpoints globally, CBRE needed a patching strategy that could scale across Windows, Linux, and third-party applications without adding operational complexity. By extending automated deployment rings across its environment, CBRE built a unified process that accelerates patch adoption, improves consistency, and greatly reduces manual effort. Join this session to see how CBRE leverages automation and Atlas-driven insights to validate outcomes, troubleshoot issues, and confidently deploy updates at enterprise scale.

At the University of Utah, standardizing endpoint management across dozens of colleges and hospitals was never technical — it was political. Departments ran their SCCM instances, and a Tanium rollout drew pushback over resource overhead and fear of losing control. Rather than mandating adoption, the Information Security Office engineered it: running Tanium as a service with low cost, letting the Software Package Gallery sell itself, building a cross-department community, and drawing one line — Threat Response stays with ISO, everything else is open. Result: ~16,000 endpoints on tag-based patching and 275+ department-run deployment jobs, with one holdout department retiring SCCM.

An assessment tells you where you stand. It was never designed to keep you there — which is why the findings list gets worked control by control, re-scanned, then worked again after the next drift. This session shows a cleaner division of labor on one platform. The benchmark becomes enforced policy, applied to your endpoints and reapplied when they drift, while an independent assessment of those same endpoints proves the enforcement held. One job sets the state, the other verifies it — and the findings list becomes evidence instead of a worklist. Tanium Atlas sits over the top: ask in plain language whether the policy applied, rank what's left, and approve remediation with a human in the loop.

The full Core & AI Services roadmap spans governance (Autonomous MSP's multi-tenant model, Agentic Policy Enforcement, and Intelligent Control's Global Maintenance Windows and Change Approval), the Atlas experience (Collaborative Pages, a Research Agent, persistent Memory), and extensibility (the Tanium MCP Server, Automate's expanding API, a next-gen Tanium Script Language). Each item ties back to Atlas's Speed, Scale, and Safety commitments.

Most DEX tools stop at a dashboard, leaving diagnosis and proof of improvement to someone else's ticket. Tanium Engage paired with Performance streams live telemetry into a DEX Score tying endpoint health to real user experience. AI-Driven Root Cause Analysis lets Atlas trace a degraded device to its root cause in moments, then resolve it via self-service or a ring-gated Automate playbook, with human approval throughout. A re-scan confirms the fix held, Connect writes the outcome to ServiceNow, and Action Oversight keeps an audit trail. See DEXOps as one Atlas-orchestrated workflow, with Background Agents watching 24/7 for 75% MTTR reduction and 95% patching efficiency gains customers are already seeing.

McDonald’s restaurant estate runs on a huge population of 4GB and 8GB RAM devices, including POS terminals, KVS, kiosks, and back-office equipment, where manual, one-device-at-a-time troubleshooting can’t keep up. The team used Tanium Atlas as a conversational root-cause partner. They correlated system and application crashes to hardware model, OS image, and RAM tier across 106 markets, and measured the real memory and disk footprint of security and business tooling under actual device stress. They also separated genuine capacity problems from stale or misleading sensor data before escalating externally. Those findings shaped how they scoped and phased deployments, and verified real impact before widening a rollout. Attendees will leave with a repeatable approach to fleet-wide performance diagnosis and safer deployments on constrained hardware.

A roadmap tour across device classes: Windows Patch Modernization (Autopatch, Hotpatch, air-gapped support), Zero-Touch & DEX (task-sequence provisioning, a cloud-connected performance and RCA agent), expanded Linux support (PatchCX, repo management, snapshots/rollback, CIS for Linux), broader ChromeOS/Android/Intune coverage, Confidence Score, and new OT protocols (BACnet, Modbus). See how Tanium Atlas ties Windows, Linux, and OT into one interface instead of three consoles.

Every AI feature that reasons over endpoint data and acts in a cybersecurity environment lives or dies on trust. Trust gets engineered into Tanium Atlas from the ground up — grounding reasoning in live endpoint truth, adding real-time web research, and building evaluation discipline at global-enterprise scale. A Tanium benchmark in development measures whether Atlas's AI does the right thing before that claim ever reaches a customer. You'll leave with a concrete picture of the engineering and evaluation work behind Atlas's Safety commitment, more than marketing language around 'trustworthy AI,' the actual mechanics of how it's tested and proven.

A race car doesn't stay competitive because of one good build; it stays competitive because a crew touches it on a fixed schedule, whether anything looks wrong or not. Tanium deployments work the same way: most degraded environments didn't fail from a bad implementation; they drifted, one skipped review at a time. This session covers the maintenance practices that keep a Tanium deployment reporting accurately at scale, agent coverage and health verification, sensor performance review, computer group and scheduled action hygiene, role and permission audits, module-level upkeep for Patch and Deploy, and platform upgrade cadence, and leaves attendees with a daily, weekly, monthly, and quarterly maintenance schedule mapped to owners they can put into practice as soon as they get home.

This combined roadmap closes the loop from all sides: External Attack Surface Management and Attack Path Mapping on exposure; Enhanced Vulnerability Scanning and Autonomous Remediation closing the fix gap; Insights Engine, Federated SOC Architecture, Agentic Threat Hunting powered by Google Threat Intelligence, and early Endpoint Vectoring/Anomaly Detection work on response. See confirmed findings route through Tanium Atlas for fleet-wide action without manual handoffs.

AHEAD has built a library of custom content that extends the Tanium Platform to automate routine work, simplify administration, and deliver complete solutions to complex customer requirements. This session gives an overview of that content and how it’s put to use, including how content management works across Tanium's Core & Endpoint Management solutions.

The internet's attack surface is changing faster than most security programs can track. This session quantifies three trends shaping that shift: AI/LLM tool exposures that surged over 60% this year, ICS infrastructure exposure that shifted by region, and threat actors using AI tooling to accelerate their attacks. Executives and practitioners will leave with the data and context to sharpen how they prioritize risk heading into 2027.

Frontier AI models can now find exploitable vulnerabilities at a pace that changes the economics of attack and defense. This session shares what Tanium's security organization is learning from using them to hunt for vulnerabilities in our own products before anyone else can. We'll cover the approaches we tested, including how we build the harnesses around models and how we triage what they find, along with the challenges we ran into and how we've dealt with them. You'll leave with first-hand results, a practical starting point for applying similar practices to your own software and systems, and a clear picture of what the coming increase in advisories and patches means for your vulnerability management program.

GRC accelerated security maturity, then stalled: we started optimizing for green dashboards and happy auditors instead of resilience. This session, based on the DVMS Institute’s Governing by Assurance series, introduces GRAA (Governance, Resilience, Assurance, Accountability) and replaces “am I compliant?” with “how resilient am I to ransomware?” With complexity outpacing governance, executives facing personal liability, and tools like Tanium, Armis, and Veza now enumerating reality in near real time, the speaker shows why siloed, vulnerability-based views must give way to attack path-based views, and how the shift extends to financial and operational resilience. Although the session is framed around cyber, the concepts extend to financial and operational resilience, so attendees from any discipline will leave with a new way to measure what their tooling is actually telling them. 

Proactive threat hunting is high-value and rare, demanding expertise and hours per hunt. Agent-Guided Threat Hunting lets a hunter describe a hypothesis in plain language while Tanium Atlas runs the hunt autonomously, mapping findings to MITRE ATT&CK. Paired with Google Threat Intelligence (private preview) — the same intelligence behind Google's own incident response, validated across 36M+ endpoints. From intel to live hunt to fleet-wide action in minutes, not days.

Patch management has historically meant reactive triage by searching, clicking, and context-switching after something's already gone wrong. This session shows the shift to proactive operational hygiene: building Patch Lists and Deployments in Tanium Patch, then layering in Ambient Agents that continuously observe the patch surface and proactively flag, or even kick off, closed-loop remediation when new CVEs or failed deployments demand attention. We'll map this to the Confidence Score roadmap, which lets you safely accelerate change instead of waiting on manual review.

McDonald’s moved endpoint management from an SCCM-centric operating model to Tanium as its enterprise platform for software deployment, patching, reporting, and endpoint operations. This session walks through how the team accelerated the migration timeline, converted thousands of deployment and operational processes, and worked through stakeholder resistance and change fatigue across global markets. It also covers how they established governance that scales, and how they carried out a controlled SCCM decommission with rollback safeguards and operational stabilization. Attendees will take away practical strategies for building executive support and driving large-scale platform change while reducing risk and maintaining business continuity.

Across this global philanthropic non-profit's server fleet, the goal was simple: one process, one tool. The organization is extending Azure Arc across its hybrid estate spanning Azure, on-premises infrastructure, and other environments to bring every machine under one governance model. As a design partner in Tanium's Azure Arc extension private preview, Avanade pioneered a native path for deploying the Tanium Client directly through that same Arc control plane, validating it end-to-end on Windows and Linux with the core agent installing in about five minutes. Where bootstrapping once meant a mix of manual installs, Group Policy, and custom extensions, the team is now automating with Azure Policy's DeployIfNotExists so every newly registered Arc machine is enrolled in Tanium, joins its dynamic groups, and inherits the patching, compliance, and configuration policies already defined. The result: Azure Arc adoption becomes an accelerant for Tanium coverage rather than a separate process to manage.

With asset visibility and patch management already established company-wide, several tasks still relied on manual effort: separating licensed from free software, prioritizing an overwhelming volume of vulnerability findings, and tracking operating systems nearing end of support. The team applied Tanium Atlas, Tanium's AI console, to all three — narrowing remediation targets by priority, classifying paid versus free software and flagging unregistered assets, and checking OS end-of-support status from real-time endpoint data. Work long deferred as a "someday" problem is now moving. Next: completing the module rollout across Deploy, Comply, and Enforce, and building an AI-embedded operating model.

Tanium runs Tanium, and this session pulls back the curtain on what that looks like day to day. Tanium's own CIO and CISO run Atlas, Automation, and the Core platform to manage and secure Tanium's global workforce in production - while also embracing key technologies from partners like Microsoft and ServiceNow to drive efficiency, rigor and capability across every endpoint.

Most endpoint tools identify what process executed. Tanium Recorder goes further, continuously capturing process, file, registry, and network telemetry — showing not just what happened, but how it unfolded across an endpoint. U.S. Bank and Tanium's HuntIQ teams will demonstrate how organizations can build and maintain a strong telemetry foundation through an ongoing process of data collection, retention, and investigation. This depth of telemetry unlocks techniques like pivoting from a single indicator to a full process lineage, confirming blast radius through network and file-write telemetry alone, and identifying which telemetry categories consistently drive successful investigations versus those that just add cost. More importantly, this session will prove how building that foundation & a corresponding process to review saves organizations critical time & delivers sharpened investigative results.

Most organizations still run IT and OT as two estates with two teams, and the first thing that breaks is the inventory. Learn how Tanium can find what is actually on the network, including the devices nobody in IT or facilities claims. Identify and classify them as what they are, whetherPLCs, HMIs, engineering workstations, or other OT/IoT devices. Then surface vulnerability and compliance findings through Comply and Exposure Management beside the IT fleet, so you can justify compensating controls where patching is not an option. From there, Tanium Atlas fills in the blanks: ask in plain language which systems run unsupported software, where else a component exists, or produce the critical-systems inventory auditors and regulators require without requiring a specialist in the loop.

Securing budget for an enterprise security platform is rarely a single team decision, especially inside a large financial services organization with dozens of cost centers and competing priorities — a challenge Corebridge Financial faced head-on when evaluating Tanium. Rather than asking one team to absorb the full cost, they found the answer inside the platform itself: Tanium's Role-Based Access Control. By mapping Tanium's RBAC model to Corebridge's internal team structure, they carved the platform into distinct, scoped environments, each giving a different business unit ownership over its own endpoints, data, and workflows — and a clear line of sight between budget contribution and value received. IT Operations, Security, and Compliance each became stakeholders in the purchase rather than passengers on someone else's procurement. This session tells that story: how RBAC became not just a security control but a commercial strategy, turning a single vendor negotiation into a multi-team win.

Refreshing hardware across a large estate traditionally means rebuilding every user's software by hand — slow, inconsistent, and a constant drain on the service desk. A Top 100 AmLaw firm and Chuco set out to make hardware refreshes a non-event by pairing Tanium with ServiceNow: the request starts in a ServiceNow ticket where the service desk already works, Tanium carries it out across the endpoints, and status flows back to the ticket automatically so no one is left chasing progress. The result is faster refreshes, a consistent software footprint, and far less white-glove effort per device. The session gives a candid look at why the firm took this on, what changed for users and the service desk, and what it actually took to build, prove, and roll out a ticket-driven, hands-off migration process across a large legal estate.

Generative AI is moving from pilot projects into production, and security teams are being asked to protect a faster, more autonomous enterprise without slowing it down. This session shows how Amazon Bedrock and Tanium Atlas work side by side: Bedrock gives organizations a secure, governed base for building and scaling AI applications, while Atlas brings agentic AI to IT and security operations using real-time endpoint data. Attendees will leave with a clear plan for adopting agentic AI on AWS with the visibility, control, and confidence security leaders need.

Most organizations see their attack surface only from the inside while attackers see it from the outside. Tanium's External Attack Surface Management now discovers every Internet-facing host, service, web property, and certificate, every 6–8 hours instead of quarterly, feeding Tanium Atlas for unified internal/external reasoning and connecting to Attack Path Mapping, which shows exactly which exposures reach your crown jewels first. The result: a single, continuously-updated picture of the full attack surface, inside and out.

Shadow AI is now a board-level risk. Employees are installing AI agents, local models, and MCP servers faster than security teams can track them. Join us for a live look at what Tanium can see today: AI tools, local LLMs, MCP servers, model files, and AI agents across your endpoints. Then watch Tanium Atlas investigate what turns up, assess the risk, and help remove unapproved tools, with a human approving every action. You'll leave knowing what's running in your environment and how to start governing it.

False positives and one-size-fits-all suppression are big reasons SOC analysts stop trusting their own alerts. This new session introduces two Security Operations capabilities landing together: Insights Engine, catching techniques like process injection with far fewer false positives, and Federated SOC Architecture, with suppression rules and response actions scoped to each team's own profile. Combine that with existing features like Threat Navigator, MITRE ATT&CK mapping, and AI enrichment for alerts and see how confirmed findings surface directly in Tanium Atlas. You'll leave with a model for higher-fidelity detection that scales cleanly across multiple autonomous SOC teams.

AI Cyber Frontier Models have rewritten the economics of cyber defense, letting attackers identify and weaponize vulnerabilities in hours and leaving defenders little margin for delay. This session examines how Exposure Management, autonomous hyper-automated patching, and AI Cyber Frontier Models work together to continuously discover, prioritize, and remediate vulnerabilities across infrastructure and applications. Attendees will learn why speed — not visibility alone — is becoming the defining factor in cyber resilience, and how leading organizations are building security programs that operate at machine speed.

Tanium Atlas puts the answers and reach of an entire team into one operator's hands. In front of a mixed technical/non-technical audience, plain-language questions prompt Atlas to assemble dynamic pages and surface next-step recommendations, every action gated by human approval. See Atlas's Speed, Scale, and Safety commitments in action today, with Background Agents, persistent Memory, Collaborative Pages, with MCP-based extensibility into Slack, ServiceNow, and Copilot arriving next.

Common tasks — pulling logs, building packages by hand, uninstalling apps at scale — take more manual effort than they should. Eager to put MCPs to work early, SimCorp built its own: pairing the Tanium API with Claude to automate package builds from Winget and GitHub, uninstall software agnostically, and handle edge cases and log pulls in seconds. An hour-long packaging process converted to a single prompt, and cleanup projects once needing hundreds of packages now need just one. Since that innovation, Tanium has launched its own Atlas MCP & SimCorp was among the early preview participants. Next: SimCorp is adapting to the Atlas MCP - uncovering additional efficiencies across the enterprise

Get ready to explore the future of agentic integrations with Tanium. This session covers two ways to extend the platform: proven APIs for established workflows, and the new Tanium MCP Server to unlock the power of Atlas for your agents. Whether you're new to Tanium or a long-time developer, this session is for you. See it live, connect with the community, and leave ready to build what's next.

AI in IT support is moving from human-assisted to autonomous, and it's already happening for Tanium and ServiceNow customers. Most conversations about agentic IT focus on platform integrations and capabilities, but this one is about the humans who make that automation trustworthy in the first place. ScreenMeet's remote support integration works natively in Tanium and ServiceNow, using AI Summaries to capture the full picture of a session — what the technician did on the endpoint and what actually happened for the end user, not just what the ticket says — which is exactly what Tanium's Atlas platform needs for fleet-wide, autonomous remediation. This session covers how AI Summaries capture that data today, what's next across coaching, KB drafting, and QA, and how it feeds Atlas, with perspective from customers living this shift. Takeaway, the Ten-Ticket Test: pull ten incidents resolved last month and try to reconstruct the reported issue, the endpoint issue, and what resolved it — if the data doesn't hold up to that test, it's not ready to power autonomous remediation either.

LLM-based tools are now embedded across cybersecurity operations — triaging alerts, summarizing threat intelligence, drafting incident reports — and are fast, cheap, and useful. They also hallucinate: per the SANS 2024 Security Operations Survey, 76% of teams use AI-assisted tools daily, and 41% have hit AI-generated hallucinations in threat reports weekly. Practical, operations-focused guidance for managing that risk is largely missing, tending toward technical failure-mode analysis or policy ignoring under-resourced teams for whom imperfect AI beats no analysis. The takeaway: keep deploying AI, but only with skepticism, verification, and frameworks for logging, validating, and trust-tiering its output.

SCCM left Air France-KLM with blind spots — unmanaged software, non-admin installs, a slow patch cycle, and stacked agents — on a fleet managed by an external partner. What began as a compliance project, run as a three-year journey across asset inventory, vulnerability management, license optimization, and lifecycle automation, uncovered a bigger opportunity. The airline joined Tanium Atlas's private preview, converting scripts and configs into lightweight sensors without an outside partner. Results: near-total endpoint coverage, recurring savings across licensing and hardware leasing, and several million euros in avoided exposure — plus a cultural shift to one trusted source of truth.

ServiceNow IT has moved from endpoint visibility to autonomous remediation. Pairing Tanium with ServiceNow, the team runs zero-touch patching, a near real-time CMDB, and agent-to-agent communication that catches problems before users feel them. Security hygiene heals itself too: Tanium finds laptops where EDR or vulnerability scanning agents are missing or not running and repairs them automatically, closing coverage gaps in hours, not weeks. The team also benchmarked agent resource utilization to see what each layer of defense costs the endpoint. The results: 35% lower MTTR, 22% less manual patching effort, and 1,500 hours saved annually, adding up to a projected $645K in yearly savings.

As a global web hosting provider, Newfold Digital is an attractive target for threat actors abusing its infrastructure for malware distribution and large-scale campaigns — and identifying affected servers used to be slow, manual work. With Tanium Live Response, the security team combines threat intelligence with rapid endpoint visibility to identify compromised systems and assess attack scope in minutes. YARA rules deployed at scale surface malware tied to emerging campaigns, and Live Response lets analysts collect forensic evidence and accelerate containment — enabling investigation without engineering or after-hours support. Result: response times cut from days to minutes.

Duke Health Technology Solutions legacy endpoint tooling required manual patch gating, physical media for provisioning, and a separate MBAM stack for BitLocker key management — all while supporting a clinical estate with no dependable maintenance window. The team migrated more than 61,000 endpoints to Tanium, retiring the legacy tooling outright rather than running parallel stacks, moved to zero-touch patching, replaced USB imaging with PXE network provisioning, and consolidated eight IT teams onto a single agent and console. The migration surfaced over 15,000 unmanaged devices, moved 30,000+ devices to Windows 11 with zero downtime, and automated the ServiceNow CMDB feed. Support case volume fell 64% as platform usage grew roughly fivefold, and the team is now building toward proactive DEX and automated security response on the same agent footprint.