Program

As Australian ports automate, cyber operations can create virtual chokepoints that disrupt trade flows, turning digital systems into national security risks.

Storing SOC playbooks as version-controlled markdown in git preserves institutional knowledge and keeps procedures maintainable without buying another platform.

GRC engineering applies automation and systems thinking to cut through tool sprawl, building workflows that continuously validate real security risk.

Real ransomware engagements show attackers are typically inside for weeks before systems lock up, and by then the data is already gone.

Threat intelligence findings trace how one phishing campaign evolved from simple lures to real-time credential and session token harvesting using AI.

Employees are feeding sensitive data into unauthorised AI tools daily, and this session argues Shadow AI is a governance failure needing practical controls.

Simple natural-language prompts can bypass expensive AI security controls, and this session maps roughly 200 documented techniques for manipulating agents.

A working proof-of-concept extension with minimal declared permissions exfiltrates page content undetected, exposing weaknesses in store review trust.

Hundreds of ransomware incident responses show the same preventable causes each time, proving the failure is now governance, not technology.

Autonomous AI agents are now running robotics and logistics systems without a human in the loop, and security architecture hasn't caught up.

Sixty years of AppSec history shows which vulnerability problems are structural, which are self-inflicted, and where security investment finally pays off.

As licensing replaces ownership across digital media, this session argues piracy has evolved into infrastructure for access and preservation.

An audit of Australia's top 50 websites found 74% at high privacy risk, showing how surveillance capitalism turns online behaviour into a tradeable asset.

A cross-disciplinary panel argues shadow IT, shadow AI and insider risk persist not from weak controls but from a gap between expected and actual behaviour.

Boards that outsource AI governance decisions to consultants may still breach their directors' duties under the Corporations Act, this panel warns.

Sophos explains how it turned unsanctioned internal tool-building by non-engineers into a governed, lightweight framework security teams can actually see.

A field-tested framework for locking down domain custody, DNS hardening and email authentication closes some of the most neglected gaps in the security stack.

A simple three-ingredient framework for everyday micro-storytelling, and why cyber professionals do not need a TED stage or hours of prep to win buy-in.

Cyber education built for enterprise risk overlooks technology-facilitated abuse, and this session shows how community-aligned roles can close that gap.

More than 80 percent of cyber professionals experience imposter syndrome, and this session examines its cost to individuals, teams and the profession.

The same cyber risk data lands completely differently with different boards, and translating it without diluting it is a leadership skill, not a soft skill.

AI-enabled disinformation is accelerating foreign interference risk in Australia, and this session examines what national coordination is doing about it.

Australia's 2025 Commonwealth Cyber Security Posture Report shows real but slow progress, with legacy systems and rigid funding still holding agencies back.