Main Program

Patching on a schedule assumed flaws surfaced on a human timescale. The case now made is for continuous risk-based visibility over raw vulnerability counts.

What employers want from cyber staff in an AI-enabled market, and how to stand out as recruitment changes, is the subject of this Careers Village session.

Sophos explains how it turned unsanctioned internal tool-building by non-engineers into a governed, lightweight framework security teams can actually see.

A field-tested framework for locking down domain custody, DNS hardening and email authentication closes some of the most neglected gaps in the security stack.

A simple three-ingredient framework for everyday micro-storytelling, and why cyber professionals do not need a TED stage or hours of prep to win buy-in.

Cyber education built for enterprise risk overlooks technology-facilitated abuse, and this session shows how community-aligned roles can close that gap.

More than 80 percent of cyber professionals experience imposter syndrome, and this session examines its cost to individuals, teams and the profession.

The same cyber risk data lands completely differently with different boards, and translating it without diluting it is a leadership skill, not a soft skill.

AI-enabled disinformation is accelerating foreign interference risk in Australia, and this session examines what national coordination is doing about it.

Ghost workers use stolen or synthetic identities to get hired, then draw salaries and reach internal systems. Lessons from emulating North Korean tradecraft.

Physical security intelligence is largely absent across SOCI-regulated operators, and this session presents a tiered framework to build that capability.

Medical device cyber incidents can directly threaten patient safety, and this session outlines a multidisciplinary incident response process built around care.

Analysis of real data from Australia's best-selling vehicle exposes the security, safety and privacy risks hidden inside connected vehicle telematics systems.

Accountability frameworks built for human decision-makers no longer answer for algorithmic failures, and this session maps where that void actually lives.

Continuous monitoring since March 2026 reveals how autonomous AI agents leak credentials into the open internet, and how to detect and defend against it.

Penetration testing reports written for engineers rarely satisfy audit committees, and this session shows how to make findings credible to both audiences.

Contract manufacturers handling customer IP need continuous visibility into data movement across endpoints and devices to prove control, not just policy.

Passkeys only strengthen security if weaker enrolment, recovery and fallback paths are closed too, since attackers will always choose the easier route.

An alternative to standard IT risk frameworks for OT environments, covering AS IEC 62443, Security PHA Reviews, and Cyber-Informed Engineering.

Simon Gribble draws on his trip to the Las Vegas cyber conference week to show how to get a real return from big events, and when to ask your employer to pay.

A certification body insider explains your rights under ISO 17021-1 and how to challenge an auditor's finding without wrecking the relationship.

In Ask an Expert 1 at 1.30pm Thursday, the expert on running secure operations and leadership, governance and accountability is Officeworks' Eshan Dissanayake.

Escape room puzzles turn compliance-driven cyber security training into engaging, hands-on group learning, and participants learn to design their own.

A hands-on workshop teaches practical email forensics so participants can confidently trace, verify, and analyse suspicious phishing messages.