Main Program

Enterprise AI governance is maturing, but independent assurance for what deployed models and autonomous agents actually do in practice barely exists yet.

A head-to-head test of leading AI models against real DFIR tasks reveals where each genuinely saves time and where it confidently misleads investigators.

Australia's AI data centre boom creates critical infrastructure risk most cyber security conversations still stop short of, from OT convergence to supply chain.

CMMC 2.0 is now contractually enforceable, and Australian defence contractors relying only on DISP and the Essential Eight face a real compliance gap.

A scan of 250 Australian Salesforce Experience Cloud sites found 56% exposing sensitive data, showing SaaS risk sits in configuration, not vendor code.

Dark web research into ransomware groups reveals how stolen data cascades through supply chains, leaving third parties unaware their information was exposed.

Cyber awareness, but make it interesting: what Star Wars, Dora, scams and coffee taught me about engaging people at ANU.

With over 30,000 cyber roles unfilled, this keynote argues rigid job models are the real barrier and makes the case for skills-based, outcome-driven careers.

For running secure operations or leadership, governance and accountability, the expert at 2.30pm Wednesday is Model Security CEO Jacqui Kernot.

Data becomes the control surface once agents hold broad access to identities and business processes, and it converges with outbound actions at machine speed.

Alert triage by hand, with no dark web or attack surface context, is the gap, and the fix offered is a four-level threat intelligence maturity framework.

As AI accelerates code production, this talk maps where it strengthens DevSecOps and where it exposes weak points in trust and review quality.

Compliance-driven supply chain reviews can mask real service-level exposure, and this session outlines a shift toward risk-adaptive vendor oversight.

A student reflects on the gap between university's technical framing of cyber security and the organisational reality of a first year as a security analyst.

A session on a voluntary, non-regulatory framework whose data security levels label data by risk and handling needs, so protection stays proportionate.

Automation in cyber security can erode judgement and obscure accountability, and this panel debates when AI use should be constrained or refused.

Three years of penetration testing data across Australia and New Zealand reveal which vulnerabilities are worsening and where security investment pays off.

Passive Bluetooth tracking data can defeat the rotating identifiers meant to protect privacy, re-identifying devices and reconstructing movement histories.

National survey data shows Australians rate disinformation a bigger threat than foreign military attack, and this briefing sets out what teams should do now.

Third-party breaches are rising fast, and this session sets out a low-cost threat intelligence model for spotting supply chain compromise before it reaches you.

Fake news investment scams expose an ownership failure hiding inside a technical problem, and this session shows how brands and regulators can close it.

Anonymised DFIR case studies show how delayed escalation and misaligned executive priorities routinely turn a manageable incident into a worse one.

A framework combining continuous security testing with adversary-based risk validation closes the gap between compliant on paper and secure in practice.