From submarines to boardrooms: Executive risk lessons from hacking military hardware

Adam Cunningham
2026-10-16 11:45 am
2026-10-16 12:25 pm
Room 218

Lessons from hacking a submarine's control systems shape five principles for communicating technical risk in terms executives will act on.

Session Details

What happens when a penetration test goes wrong in the most literal sense possible? When your "test environment" is a multi-billion-dollar submarine capable of carrying nuclear weapons, and your mistake could literally crush the vessel?

Join Adam Cassoni Cunningham for a rare glimpse into the untold story of how military-grade hacking experiences shaped one cybersecurity leader's approach to executive risk management. This isn't another technical deep-dive into vulnerabilities—it's a masterclass in translating life-or-death security lessons into boardroom decisions.

The Story That Changed Everything:​

In 2001, before the cyber security industry even had proper tools, within a test Adam gained unauthorised access to submarine systems. The attackers could manipulate critical depth readings, potentially sending the vessel to crush depth. No penetration test reports, no compliance frameworks—just pure, unadulterated risk where mistakes meant lives, not just data breaches.

Five Principles That Will Transform How You Communicate Risk:​

  1. The Illusion of Choice: Why giving executives options beats pushing solutions
  2. Screenshot or It Didn't Happen: How to cut through theoretical risks and focus on real threats
  3. The Three F*s Framework: The brutally simple test for every security message
  4. Blast Radius Thinking: Prioritising by actual business impact, not CVSS scores
  5. The Attacker's Economics: Why boards fear the wrong things and how to fix it

You've seen the technical presentations. You've read the compliance guides. But have you learned how to make a CFO understand why that vulnerability actually matters? This session bridges the gap between hacker instincts and executive communication, showing you how to protect systems by first protecting the truth.

Perfect for:​

  • CISOs, CIOs, COOs, CEOs and Security Directors
  • Security professionals ready to transition to leadership
  • Anyone who's ever struggled to explain technical risk to business executives

This isn't theory. These are battle-tested principles forged in the crucible of real consequences, where security failures could literally mean the difference between surface and crushed steel.

Warning: May cause permanent changes in how you approach risk communication.

There's More Where This Came From

Browse hundreds of sessions and build an agenda around the topics that matter to you.

Speaker in a grey suit presenting at a lectern on stage
Woman being interviewed with a Ticker microphone on the expo floor
Audience members smiling and taking photos on their phones during a session
Speaker presenting on stage against a blue and pink backdrop
Attendees wearing CyberCon headphones listening during a session
Panellists seated in white armchairs on stage during a conference discussion
Keynote speaker presenting on stage with a title slide behind him
Speaker addressing the audience with a microphone as a colleague looks on