Main Program

Threat actors have moved from early monetisation schemes to AI-driven operations, and the response side has to modernise to keep pace.

Hands-on findings on GPU container escapes, model-weight side channels, and agent trust failures that traditional cloud native tooling misses entirely.

An internal OSINT challenge covering 94 tasks showed staff across a power network how everyday online activity can expose far more than they realise.

National research across school outreach, university and workforce entry reveals a pathway continuity problem, not a talent shortage, and how to fix it.

Borrowed from military doctrine, centre of gravity analysis identifies the one dependency an attack would need to disrupt, making prioritisation defensible.

From Stuxnet to NotPetya to a 2026 wiper attack on Stryker, this session tracks how state-built cyber weapons keep spilling over onto ordinary enterprises.

As Australian ports automate, cyber operations can create virtual chokepoints that disrupt trade flows, turning digital systems into national security risks.

Storing SOC playbooks as version-controlled markdown in git preserves institutional knowledge and keeps procedures maintainable without buying another platform.

GRC engineering applies automation and systems thinking to cut through tool sprawl, building workflows that continuously validate real security risk.

Real ransomware engagements show attackers are typically inside for weeks before systems lock up, and by then the data is already gone.

Threat intelligence findings trace how one phishing campaign evolved from simple lures to real-time credential and session token harvesting using AI.

Employees are feeding sensitive data into unauthorised AI tools daily, and this session argues Shadow AI is a governance failure needing practical controls.

Simple natural-language prompts can bypass expensive AI security controls, and this session maps roughly 200 documented techniques for manipulating agents.

A working proof-of-concept extension with minimal declared permissions exfiltrates page content undetected, exposing weaknesses in store review trust.

Hundreds of ransomware incident responses show the same preventable causes each time, proving the failure is now governance, not technology.

Autonomous AI agents are now running robotics and logistics systems without a human in the loop, and security architecture hasn't caught up.

Sixty years of AppSec history shows which vulnerability problems are structural, which are self-inflicted, and where security investment finally pays off.

As licensing replaces ownership across digital media, this session argues piracy has evolved into infrastructure for access and preservation.

An audit of Australia's top 50 websites found 74% at high privacy risk, showing how surveillance capitalism turns online behaviour into a tradeable asset.

Building secure technology and leadership, governance and accountability sit with ERQI co-founder Sriram Raghavan at 11.45am Thursday in Ask an Expert 1.

Analysts chasing alerts gives way to analysts and AI agents investigating together and acting in real time, which is the shift this session describes.

A cross-disciplinary panel argues shadow IT, shadow AI and insider risk persist not from weak controls but from a gap between expected and actual behaviour.

Boards that outsource AI governance decisions to consultants may still breach their directors' duties under the Corporations Act, this panel warns.