CISO Sydney schedule

 In this 5-minute networking session, the goal is to connect with three new people. Enjoy the opportunity to expand your network! 

Security's traditional model of assess, approve, and monitor was built for systems that stayed largely the same between reviews. Agentic AI doesn't. By the time governance signs off, the system may already have changed. This fireside chat explores whether governance can adapt to machine-speed decision making, or whether organisations must rethink ownership, controls, and risk appetite altogether.

• Is "human-in-the-loop" becoming a compliance theatre rather than a meaningful control?
• Who is accountable when an AI agent takes an action nobody explicitly anticipated: the builder, the operator, the business owner, or the AI itself?
• If you tried to fund continuous assurance today, what would you be asking your board for?

Moderator:

Anthony Rizzo State Councillor NSW ACT Governance Institute of Australia

Speakers:

Chris Grisdale CISO Circular Economy Systems (CES)

Aseem Goswami Cluster ISO - Australasia Munich Re 

 AI agents are poised to transform enterprise operations, but they also introduce unprecedented identity and security challenges. In this session, HashiCorp and IBM will discuss the emerging risks associated with agentic AI and share a framework for securing autonomous systems through modern identity, access, and governance controls. Discover how leading organizations are preparing to scale AI adoption while maintaining security, compliance, and operational resilience. 

 

Cyber incidents require coordinated decisions across security, risk, legal, communications and operations leaders. During this tabletop exercise, panellists will take on executive roles during the exercise. Join us to discover:

• How different executive roles frame risk and urgency during a live incident
• What triggers executive escalation and board involvement
• How decisions change as facts emerge and assumptions are challenged
• What alignment looks like when speed, accuracy, and accountability collide

Facilitator:

Chirag Joshi Founder & CEO 7 Rules Cyber 

This keynote will explore what happens to security, resilience and sovereignty when AI becomes business-critical infrastructure, examining how the foundations of the AI economy are evolving and what this means for organisations.

• How is the infrastructure supporting AI changing the enterprise risk and resilience equation?
• Where are new concentrations of risk and dependencies emerging across interconnected digital infrastructure?
• What does resilience look like when AI becomes embedded in business-critical operations? 

This plenary explores how organisations can better understand and manage data risk across cloud and SaaS environments. As sensitive information becomes more distributed, leaders need greater visibility, clearer accountability, and stronger governance. The discussion focuses on turning data insights into informed decisions that reduce risk and support business objectives.

Open-weight AI models are closing the capability gap on frontier systems within months, putting sophisticated offensive capability within reach of a much wider range of actors. This panel brings together government and industry to examine what that shift means for Australia's collective defence, what's already underway, where the hardest challenges sit, and what security leaders need to do in response.

• Where is Australia’s collective defence against freely available AI capability and where does it need to move fastest?
• How should government, industry and critical infrastructure share responsibility as this threat scales?
• What does real readiness look like 12 months from now?

Panellists:

Ciara Spencer Deputy Secretary, Law Enforcement & Domestic Security Department of Home Affairs

Tamoor Sarfraz CISO Adbri  

AI embedded capabilities rapidly enter the enterprise, organisations are facing growing challenges around visibility, accountability, and third-party risk. This session explores how cyber leaders are approaching trust, governance, and supply chain security in increasingly AI-driven ecosystems. 

Assurance models are built to give confidence that risk is under control, until the moment they're tested and found wanting. This case study examines one organisation's real assurance model that looked solid on paper and broke in practice, what the failure actually revealed, and what had to change structurally, not just cosmetically, to rebuild something that could be trusted again.

Digital trust is being redefined as identity threats grow more complex. From deepfakes and impersonation attacks to the rapid rise of non-human identities, the identity landscape is evolving. This session explores what these changes mean for verification and control and how security leaders can adapt their strategies to safeguard trust today.  

AI adoption rarely waits for governance to catch up. Torrens University Australia shares its journey of developing an AI governance approach across a diverse, multi-campus university, navigating the practical challenges of accountability, risk, responsible adoption and organisational change. What worked, what proved difficult, and what would they do differently?

This keynote explores how accelerating cloud adoption, AI-driven threats, and increasingly distributed environments are reshaping the fundamentals of cyber security. As organisations modernise, security teams are under pressure to move faster while maintaining control and visibility. The session examines how leaders can rethink architecture, operating models, and decision-making to build resilience in environments where change is constant and attack surfaces continue to expand. 

This panel discusses how security operations must adapt as AI agents begin taking autonomous action across systems, applications and data.

• How do you spot legitimate vs malicious agent behaviour?
• Who owns an incident caused by an AI agent?
• What changes across detection, response and human oversight?
• How much autonomy should security teams allow?

Panellists:

Umair Zia A/Director Infrastructure & Service Delivery Sydney Local Health District  

 

As phishing, business email compromise and identity-driven threats continue to evolve, attackers are focusing less on systems and more on people. This discussion examines how security teams can identify risky behaviour signals, improve visibility across communication channels, and strengthen early detection capabilities. 

Traditional vulnerability management was built for a world where defenders had weeks to respond. With exploitation accelerating and vulnerability discovery scaling through AI, that model is becoming increasingly difficult to sustain. This session introduces VulnOps, a continuous, risk-driven approach that combines business-context prioritisation, AI-assisted remediation and guarded automation. Discover how security teams can move beyond fragmented findings and patching SLAs to reduce exposure, make faster remediation decisions and keep pace with an evolving threat landscape.

This session explores how to keep messages clear, consistent, and credible under pressure, from briefing executives and coordinating teams to managing regulators and public statements. Learn practical techniques to maintain trust, reduce confusion, and keep everyone aligned when the stakes are highest.

Organisations face more vulnerabilities and exposures than they can realistically address at once. Threat intelligence can help security teams move beyond severity scores alone to understand which exposures pose the greatest risk in the context of active threats, exploit activity and their own environments. This session explores how to combine threat intelligence with exposure data to prioritise remediation, focus limited resources where they matter most, and reduce the window of opportunity for attackers.

As attack surfaces expand across cloud, hybrid environments and third party systems, visibility alone is no longer enough. The discussion looks at how security teams can detect high risk assets, prioritise what matters most, and accelerate remediation before threats are exploited. It also examines how continuous exposure management helps strengthen defensive posture and reduce the window of opportunity for attackers across the enterprise.

AI-generated voice and video have reached the point where they can convincingly impersonate executives, authorising payments and issuing instructions nobody would think to question. This session examines how deepfake-driven social engineering is actually being used against organisations today, and what it means for verification and trust when identity itself can no longer be confirmed on sight or sound.

This session explores how organisations can rethink software supply chain security as open source and containerised environments reshape modern development. As risk increasingly originates upstream, reactive patching is no longer enough. The discussion looks at how teams can build trust into the software lifecycle, reduce dependency risk, and adopt secure-by-default approaches through stronger provenance, build integrity, and earlier security integration. 

The CISO role is expanding, but what happens when you’ve reached the top of the security function? This candid panel explores where experienced security leaders go next, from broader C-suite and CEO roles to boards, advisory and industry leadership.

• If CISO is the top job in security, where do you go when you’ve outgrown it?
• Why aren’t we seeing more CISOs become CEOs? Can a CISO climb the corporate ladder to CEO?
• When you consider your next move, what matters most: scope, influence, impact or title?
• What doors does the CISO role open beyond security?

Speakers:

Chirag Joshi Founder & CEO 7 Rules Cyber

River Nygryn CTO CRVAA  

Most board communication advice assumes boards behave the same way. They don't, and the gap between what a CISO assumes their board needs and what it actually needs is where credibility is won or lost. This fireside chat goes beyond the anecdote of a board saying no despite understanding the risk, to the harder, more useful question: how do you actually find out what your board needs before you're standing in front of it, finding out the hard way.

• What your board actually decides on, versus what you've been assuming
• How to find out before you're guessing in front of them
• What changes the moment you get it wrong

Speakers:

Sasha Biskup CISO DroneShield

Martin Doherty CISO Australia & New Zealand HSBC

Tony Mckeown CSO KBR 

Technical operator or business leader — organisations increasingly want different things from the same title, often without deciding which one actually makes sense for them. This keynote confronts that tension directly and the question underneath it: how boards perceive the CISO function and whether that perception matches what the role now actually requires.

Speakers:

Gaurav Sharma CIO NSW Ports  

Dane Warren CISO Department of Transportation

Andrew Karvinen CISO Macquarie University   

This keynote explores how IT and security teams are adapting to rising operational complexity across distributed environments, growing toolsets, and increasing service demands. Explore how teams can streamline workflows, improve coordination across tools and services, and ensure security outcomes remain reliable without adding unnecessary operational overhead. 

Panellists are presented with a realistic scenario involving a strategic cyber security decision, such as a budget investment, risk acceptance, ransomware response, or major business trade-off. After making their decision, they will face unscripted questioning from fellow panellists acting as board-level stakeholders. This session explores how leaders justify cyber decisions under pressure, communicate risk in business terms, and defend their reasoning against board-level scrutiny.

Speakers:

Leron Zinatullin CISO Constantinople

Shad Thakkar CISO Department of Climate Change, Energy, the Environment and Water

Eric Pinkerton Group Head of Information Security AUB Group 

Risk is no longer driven primarily by single control failures. It is amplified by interdependencies, overlapping platforms. unclear ownership and fragile integrations. This keynote explores how complexity itself has become the dominant risk multiplier in modern environments, and why CISOs are increasingly focused on reducing coupling and blast radius rather than maximising coverage.

SOCI reform is raising expectations for how organisations manage cyber, operational, and supply chain risk. This session examines the shift from compliance to resilience, the questions boards and regulators are asking, and the practical steps CISOs can take to demonstrate readiness when it matters most.

Moderator:

Lauren Veenstra CSO Ibedrola Australia

Panellists:

Lee Barney CISO Ventia

Nuno Duarte Cyber Principal Telstra

Raghu Gandhy CISO Veolia 

When breaches occur, the difference between disruption and containment is rarely speed alone.  This session explores practical segmentation approaches that actually get deployed, including enforcement points and operational impact in complex environments. 

Since December 2026, the Privacy Act's new transparency requirements have obliged organisations to disclose exactly where personal information feeds into automated decisions that affect people, in hiring, credit, insurance, and fraud detection. This session confronts what compliance actually requires in practice and whether most AI systems could even produce the answer if asked.

Speakers:

River Nygryn CTO CRVAA  

Maryam Shoraka Corinium’s CISO Advisory Board Member  

AI is changing not only how data is used, but where it moves, who interacts with it, and how quickly it leaves traditional governance boundaries. As organisations adopt copilots, embedded AI tools, and autonomous workflows, leaders are being forced to rethink long-held assumptions around visibility, control, and accountability.  

The entry-level work that used to build a senior analyst's judgement, triage, pattern recognition and incident response under pressure, is exactly the work AI is now best placed to automate. This session asks whether AI is quietly breaking the traditional apprenticeship model that produces cyber security expertise, and what organisations need to build in its place. 

This session explores how to build an AI literacy programme that empowers your people to use AI confidently and safely. Learn practical approaches for training, cultural adoption, and governance to turn AI from a tool into a capability that supports smarter, more informed decision-making across your organisation.  

Most security dashboards measure activity rather than outcomes: patches applied, trainings completed, alerts closed, all looking equally reassuring either way. This session discusses the gap between what a board actually learns from typical security reporting and what it assumes it's learning, and what it would take to report effectiveness rather than effort.

Trusted access pathways can be exploited through remote hiring models, identity deception, and credential misuse, creating hybrid forms of insider risk that are difficult to detect using traditional controls. This session explores how these scenarios emerge in practice, and what they reveal about strengthening identity assurance, access governance, and accountability in complex operating environments.  

AI is redefining how organisations anticipate, respond to, and recover from cyber threats. As attacks grow faster and more complex, resilience depends on the ability to predict risks, accelerate decisions, and adapt in real time. This session explores how AI is helping organisations move beyond reactive defence and build a more resilient future.

Enterprise data now flows through SaaS platforms that embed AI capabilities and introduce processing layers beyond the original system boundary often past the point where any single organisation can fully see where its data goes. This session explores how AI-enabled SaaS is reshaping data sovereignty, where organisations are losing visibility across increasingly complex data flows, and what CISOs can do to regain control. 

The instinct to block risky behaviour can create a false sense of security, particularly when people simply find another way around the control. This candid fireside chat explores when prevention stops being effective, where visibility and trust can be stronger security strategies, and what security leaders should stop trying to control.

• What's a control you've removed or relaxed, and what actually happened afterwards?

• Where do you draw the line between "monitor it" and "stop it outright"?

• Can too much control create bigger blind spots?

• What are security leaders still trying to control that they realistically can't?

• If someone routed around one of your controls tomorrow, would you know?