Program

A university-wide Cyber Champions Program grew to over 150 staff and measurably lifted security awareness and behaviour across the institution.

Analysis of AI whistleblowing cases reveals a gap between what AI systems can do and what governance can detect, using disclosure as a diagnostic signal.

Drawing on five years of regulator decisions, this session sets out a defensible, privacy-first governance framework for facial recognition technology.

A fake Australian financial services firm, built with synthetic data and left online, reveals exactly how real attackers reconnoitre, exfiltrate and negotiate.

Lessons from Colonial Pipeline, Oldsmar, and other landmark OT attacks build a practical post-incident framework for Australian critical infrastructure.

Most organisations already own the tools for continuous threat exposure management; this session explains the structures needed to make them work.

Enterprise AI governance is maturing, but independent assurance for what deployed models and autonomous agents actually do in practice barely exists yet.

A head-to-head test of leading AI models against real DFIR tasks reveals where each genuinely saves time and where it confidently misleads investigators.

Australia's AI data centre boom creates critical infrastructure risk most cyber security conversations still stop short of, from OT convergence to supply chain.

CMMC 2.0 is now contractually enforceable, and Australian defence contractors relying only on DISP and the Essential Eight face a real compliance gap.

A scan of 250 Australian Salesforce Experience Cloud sites found 56% exposing sensitive data, showing SaaS risk sits in configuration, not vendor code.

Dark web research into ransomware groups reveals how stolen data cascades through supply chains, leaving third parties unaware their information was exposed.

With over 30,000 cyber roles unfilled, this keynote argues rigid job models are the real barrier and makes the case for skills-based, outcome-driven careers.

As AI accelerates code production, this talk maps where it strengthens DevSecOps and where it exposes weak points in trust and review quality.

Compliance-driven supply chain reviews can mask real service-level exposure, and this session outlines a shift toward risk-adaptive vendor oversight.

A student reflects on the gap between university's technical framing of cyber security and the organisational reality of a first year as a security analyst.

Automation in cyber security can erode judgement and obscure accountability, and this panel debates when AI use should be constrained or refused.

Three years of penetration testing data across Australia and New Zealand reveal which vulnerabilities are worsening and where security investment pays off.

Passive Bluetooth tracking data can defeat the rotating identifiers meant to protect privacy, re-identifying devices and reconstructing movement histories.

National survey data shows Australians rate disinformation a bigger threat than foreign military attack, and this briefing sets out what teams should do now.

Third-party breaches are rising fast, and this session sets out a low-cost threat intelligence model for spotting supply chain compromise before it reaches you.

Fake news investment scams expose an ownership failure hiding inside a technical problem, and this session shows how brands and regulators can close it.

Anonymised DFIR case studies show how delayed escalation and misaligned executive priorities routinely turn a manageable incident into a worse one.