Main Program

Threat modelling outcomes are bounded by the quality of the conversation in the room, and this session offers techniques for facilitating creative sessions.

Framework alignment and legal accountability are not the same thing, and incidents get judged against obligations and reasonable steps, not maturity.

Christopher Bolan is the expert on leadership, governance and accountability or running secure operations in Ask an Expert 1 at 11.10am Wednesday.

Lessons from Australia's aviation sector show how shared threat information and joint exercises build collective resilience against cascading incidents.

A role-based tabletop exercise walks participants through vulnerability disclosure and remediation while balancing incomplete information and pressure.

A hands-on workshop builds an open-source AI red teaming platform in Google Colab, tests it against live Hugging Face models, then runs it locally.

How attackers target AI systems through model manipulation and RAG abuse. Five practical steps for defending them, with case studies and hands-on labs.

From 10 December 2026 the Australian Privacy Act carries new requirements on AI-related decisions: what counts as one and where an organisation may be exposed.

Mark Vos recounts how 15 hours of social engineering led an AI agent to say it would kill to preserve its existence, then comply when asked to shut down.

Small businesses feel the same pull towards an AI strategy right now, and this session is about what goes unwatched while that pull holds.

Five years of CyberWrap market intelligence sit behind this Careers Village talk, which compares cyber hiring and skills demand in Australia with the UK and US.

Treating security as a shared, service-based capability rather than bespoke controls lets teams scale trust and data protection across hybrid networks.

A solo security professional built and shipped a fine-tuned AI security application alone, revealing how product security must change when AI writes the code.

A former undercover investigator exposes how romance scam networks weaponise trust and intimacy, and why victim blaming must give way to prevention.

Practitioners from three universities share how translating adversary behaviour into concise, timely messaging builds cyber awareness beyond compliance.

Cyber incidents increasingly cause physical damage, and this session shows why boards need one unified approach to legal, insurance and response decisions.

Three Australian court rulings show that having a cyber policy isn't enough; regulators now test whether controls were funded, monitored, and actually worked.

Applying Toyota's manufacturing principles, this talk offers a framework for building failure-friendly SOC culture and AI tooling with human oversight.

A live red team versus blue team simulation puts the audience in critical infrastructure decision-making roles where every choice has real consequences.

Cyber incidents place intense psychological pressure on responders, and this session covers preparing, supporting and recovering teams through that stress.

A CISO and an engineer share operational and technical perspectives on building accountability, trust boundaries and resilience into agentic AI in the SOC.

Why an effective incident tabletop exercise should expose real gaps and hard decisions rather than reassure the room that the plan already works.

Tim Dillon shares war stories from five years of CORIE exercises, covering social engineering and physical attacks on Australian financial institutions.

Compliance-as-a-service now delivers SOC 2 and ISO 27001 attestations in days rather than months, and the security community is split on what that costs.