Event Agenda
28th – 29th September, 2027 // Melbourne, Australia
We are currently working on the ANZ Cyber Summit’s 2027 agenda and will be updating it soon.
In the meantime, take a look at the topics and themes discussed as part of the 2026 agenda:
| Day 1 // 15th September 2026 08:50 – 17:20 |
|
 |
08:00Registration & Coffee |
|
08:50Opening Address by the Chair: Gaurav Vikash, Head of Security and Risk – APAC, Axon |
 |
09:00 As global volatility intensifies, geopolitical tension has become an operational reality for Australian and New Zealand organisations. In this expert panel discussion, we explore how instability impacts our cyber security, the knock-on effect for our relationship with global vendors, and what officials and security leaders must do now to protect against future shifts in global alliances. . • How are global tensions manifesting as direct threats to Australian and New Zealand enterprise networks? • Can we identify and mitigate sovereign risk within our technology stacks and third-party partnerships? • How can the private sector better align with the ASD’s “Five Eyes” intelligence and “Secure by Design” mandates to create a collective defence? . – Moderator: Vanessa Tsaccounis , CISO, University of Wollongong – Dr. Tom Gao, Chief Technology and Digital Services Officer, City of Sydney – Adam Byrne, Group CSO, The Adecco Group – Amritha Shetty, Senior Manager – Technology & Cyber Security Governance Risk & Compliance, The Lottery Corporation – Craig James, Head of Value Advisory and Strategy (APAC), Cloudflare . |
|
09:50 AI has empowered employees to build custom applications at light-speed, but it has also supercharged attackers. Today, frontier models like Mythos can compress the timeline from vulnerability discovery to active exploit to under 24 hours. Caught between rapid internal “vibe-coding” and hyper-automated external threats, traditional patching and GRC gatekeeping are officially broken. This session outlines how to pivot to a “secure-by-default” architectural framework that contains threats automatically without stalling business innovation. . • The Mythos Reality: Why attempting to out-patch AI-driven threats is a losing battle, and how to adapt your GRC playbooks • Blast Radius Containment: Practical strategies using Serverless V8 Isolates and Zero Trust to ensure a flaw in a rogue employee app cannot grant lateral network access • Securing AI Agents: How to use centrally managed Model Context Protocol (MCP) portals to safely connect AI tools to core systems (like Salesforce and Jira) with full governance . – Tim Obezuk, Senior Specialist Solutions Engineer, Cloudflare . |
 |
10:30Networking Break |
|
11:10 Cyber threats are evolving rapidly across APAC, with identity now the new perimeter and attackers increasingly exploiting legitimate remote management tools, business email compromise and AI-powered social engineering. Drawing on real incident data, this session examines why some sectors remain prime targets, how attackers are prioritising stealth, data theft and extortion, and the practical steps organisations can take to detect threats earlier and strengthen cyber resilience. . – Reece Appleton, Regional Director (APAC), Huntress |
 |
11:40 As organisations race to integrate Generative AI, the boundary between innovation and risk has never been thinner. In this case study session, our expert speaker moves beyond theoretical frameworks to provide a candid look at how a leading enterprise successfully implemented its AI governance structure. We will explore the journey from managing “Shadow AI” to establishing a robust, scalable environment that prevents data leakage whilst empowering users. . • Learn how we moved from reactive AI bans to a proactive, risk-based governance model • Hear practical techniques for monitoring and securing sensitive corporate data within third-party GenAI tools • Define the roles of Security, Legal, and IT in building a sustainable AI Oversight Committee . – Gaurav Vikash, Head of Security and Risk – APAC, Axon . |
|
12:20 Agentic AI workers are changing the endpoint security model. Tools such as ChatGPT Codex, Claude Code, and Google Antigravity do more than respond to prompts. They reason, persist, adapt, and take action using the privileges of the interactive user. Join Airlock Digital for a governance tips session on how a deny-by-default application control model can help organizations govern agentic AI workers without slowing adoption. . – Josh Schwarz, Sr. Sales Engineer, Airlock Digital . |
|
12:30 The Security Operations Centre is at an inflection point. While threats are becoming increasingly sophisticated and automated by Generative AI, traditional SOC models often struggle with alert fatigue, manual processes, and skills gaps. In this session, we provide a roadmap towards SOC 3.0 for security leaders to navigate this evolution, outlining the necessary changes to remain resilient against next-generation attacks. . • Implementing XDR and AI for threat prediction and autonomous response • Automate tasks to reduce alert fatigue and improve MTTD/MTTR • Benchmark SOC maturity and planning infrastructure investment for human-AI collaboration . |
 |
13:00Lunch hosted by Cloudflare |
|
14:00 Emerging technologies, including sophisticated Cloud services, AI, and distributed architectures, offer immense opportunities but simultaneously introduce profound security and compliance challenges. In this fireside chat session, our expert speaker, in conversation with our moderator, addresses how to embed security early and proactively manage these risks. Learn how security teams can collaborate with innovation units to safeguard emerging environments, ensuring regulatory adherence is built into your enterprise architecture from the outset, turning technological evolution into a competitive advantage rather than an unmanaged liability. . • How do we create future-proof security governance frameworks that adapt to new technology? • Are there any practical methods you’ve found for safeguarding large-scale public Cloud and AI/ML adoption? • What is the best way to integrate compliance and security into the innovation and development lifecycle? . – Peter Davidoff, Head of Cyber Security Architecture and Assurance, Department of Defence – Faz Rahman, Head of Information Security, NOW Finance . |
|
14:30 As we all know, your security is only as strong as its weakest link. In this case study session, our expert speaker offers a candid deep-dive into the practicalities of auditing third-party IT vendors. We will examine the transition from “tick-box” compliance to a proactive risk strategy, navigating vendor transparency and remediating critical vulnerabilities before they impact your perimeter. . • Learn how to balance rigorous technical oversight with business agility, ensuring external partnerships remain an asset rather than a liability • Get a step-by-step look at our vetting process, from initial RFI to robust SOC report analysis • See how we managed high-risk discoveries in “business-critical” software without stalling project timelines . – Nikita Newell, CISO, Lendlease . |
|
15:00 When critical infrastructure collapses, a company’s survival hinges on operational resilience, not just digital defences. In this session, our expert speaker, in conversation with our moderator, explores how organisations can maintain continuity when technology completely fails. We will examine the transition from automated systems to manual protocols, ensuring your business remains functional during catastrophic downtime. Designed for CISOs and risk leaders, this fireside chat session delivers actionable strategies to minimise chaos, manage stakeholder expectations, and orchestrate a swift, secure recovery when the grid goes dark. . • Establish robust, non-digital protocols for critical operations • Manage internal chaos and external reputation during outages • Prioritise assets to ensure rapid, orderly system restoration . – Moderator: Edwin Kwan, Head of Product Security, CoStar Group – Roger Millar, CIO/CISO, Angus Knight Group . |
|
15:30Networking Break |
 |
16:00 T1. What Do We Do When Tech Fails? . T2. Are We Building Cloud Systems that are Too Fast to be Defended? . T3. Can We Secure Our Data in the GenAI Era? . |
|
16:40 Despite the best efforts, the human factor remains the biggest risk factor for cyber attacks. In this CISO-led case study, our speaker demonstrates a successful transformation to an active, measurable security culture, proving that people can be your strongest defence layer. We will explore the strategic decisions used to change employee behaviour at scale. . • Devise strategies for gamification and continuous, relevant training and campaigns, using measurable behavioural change, not just click rates • Tailor content and messages for high-risk roles, ensuring there are mitigations against data loss • Hear different techniques for continuous reinforcement of good cyber hygiene practices . – Adrian Kazias, Senior Manager, Cyber Defence & Resilience, Commonwealth Superannuation Corporation . |
|
17:10Closing Remarks by the Chair: Gaurav Vikash, Head of Security and Risk – APAC, Axon |
 |
17:20Drinks Reception |
| Day 2 // 16th September 2026 08:50 – 17:20 |
|
|
08:15Registration & Coffee |
|
08:50Opening Address by the Chair: Gaurav Vikash, Head of Security and Risk – APAC, Axon |
|
09:00 For a long time, we have been focused on preventative measures to keep attackers out. Yet even the most sophisticated defences can be bypassed. The critical question facing modern leadership is no longer just how to prevent an intrusion, but how to ensure the business continues to function while under fire. In this expert panel discussion, we bring together industry leaders to debate the balance between Cyber Security (the art of prevention) and Cyber Resilience (the art of survival). . • Has our obsession with being “unhackable” actually made us more vulnerable to a total system collapse? • How do we architect systems that allow for localised failures without compromising the entire enterprise? • How do we train executives and boards to view a breach not as a binary failure of IT, but as a manageable business risk? . – Moderator: Nick Moore, Principal Cyber Risk Engineer, Liberty Specialty Markets – Deepthi Nair, Director, Cyber Security & Information Management, Yooralla – Jess Thomas, Assistant Director, Cyber Security Engagement NSW/ACT, National Office of Cyber Security, Australian Department of Home Affairs – James Kearney, Executive Manager Cyber, Commonwealth Bank – SOCRadar . |
|
09:50 In 2026, the rise of Agentic AI has fundamentally altered the cyber landscape. These autonomous systems do not merely follow scripts; they reason, adapt, and pivot, allowing adversaries to launch sophisticated, self-correcting attacks at machine speed. To survive, organisations must evolve from manual oversight to an “AI-versus-AI” defensive posture. This session explores the dual nature of agentic technology. We examine how to secure non-human identities against malicious agents while simultaneously leveraging autonomous defenders to outpace threats. Join us to learn how to integrate these powerful tools into your security architecture without sacrificing human governance or control. . • Identify and disrupt autonomous reasoning chains used by nation-state AI swarms. • Deploy autonomous agents to automate complex incident response and real-time threat hunting • Implement robust “kill switches” and guardrails to maintain oversight of your non-human workforce . |
|
10:20Networking Break |
|
11:00 As organisations transition to autonomous multi-agent systems, the attack surface shifts fundamentally. This session delivers practical, architectural learnings from real-world scaling, focusing on splitting complex requirements into cohesive, specialised agents. We explore choosing the right model, data, and hosting infrastructure for each component—balancing on-premises, endpoint, and cloud deployments—whilst addressing cross-cutting concerns like DLP and prompt injection protection. Attendees will examine battle-tested identity deployment patterns, from micro-identities over zero-trust web channels for small scales, to high-end Kubernetes architectures using Authentik. . • Decompose requirements into individual, right-sized agents with tailored models, data, and cost-effective hosting • Implement strategies for micro-identities over zero-trust web channels versus high-end Kubernetes clusters • Embed robust data loss prevention and prompt injection protection across distributed agentic pipelines . – Colin Renouf, CISO, Healius . |
|
11:30 The SANS ICS 5 Critical Controls were crafted meticulously with analysis of compromises and cyber attacks in industrial companies worldwide. In this session, we discuss the data behind the Controls, as well as presenting them as a framework for a set of measures specifically designed for the prevention, detection, and response to cyber incidents in industrial environments. Join us to hear an insightful review of how the 5 controls can help you achieve better alignment across your IT and OT security teams. . . |
|
11:40 The increasing reliance on external vendors and OEMs necessitates a robust, compliant approach to remote access within OT networks. In this session, we focus on the practical lessons learned from deploying a unified secure remote access (SRA) framework designed to manage hundreds of third-party connections across disparate industrial control systems. We will detail the architectural and procedural strategies required to move beyond fragmented vendor-specific solutions toward a single, auditable platform. . • Hear strategies for consolidating third-party access solutions into a unified SRA platform • Learn best practices for integrating PAM and SRA to enforce ‘just-in-time’ and ‘least-privilege’ access policies in OT • Discover techniques for building a continuous auditing and compliance reporting structure to satisfy internal and regulatory mandates . – Gursimran Tiwana, Head of Cyber Security, Lumus Imaging . |
|
12:10Lunch |
|
13:10 Modern software delivery pipelines are increasingly targeted by sophisticated supply chain attacks that exploit open-source code and automated build infrastructures. When attackers target build steps and upstream dependencies, traditional perimeter security falls short. In this session, our expert speaker demonstrates how to embed robust defences directly into the software development lifecycle to prevent compromised dependencies from reaching production. We will examine practical techniques for validating third-party packages, securing CI/CD pipelines, and establishing cryptographically verified build outputs. Gain actionable strategies to transform your build environment into a resilient, tamper-evident barrier against software supply chain compromises. • Implement automated tooling to analyse open-source dependencies and block malicious packages before integration • Hardening CI/CD pipelines and build servers against unauthorized code execution and secret leakage • Establish cryptographic build provenance and Software Bills of Materials (SBOMs) to verify code integrity at deploy time . – Didar Chy, Information Technology Security Architect, Reserve Bank of Australia . |
|
13:40 The disconnect between IT Operations (uptime) and Security (risk) often creates friction, delays, and critical vulnerabilities. In this session, our speaker offers a practical blueprint for transforming security into an integrated, shared responsibility across your organisation. We explore how to dismantle silos and implement a true SecOps culture. . • How do we establish unified communication and collaborative workflows, and align KPIs so both teams own cyber risk and efficiency? • What methods have you found to integrate security testing and response directly into IT deployment pipelines? • How can we train IT staff on security principles and SecOps staff on operational constraints? . – Sanja Petrovic, General Manager, Cyber Security & Governance, HUB24 . |
|
14:10 In an increasingly complex threat landscape, traditional perimeter-based security models are no longer sufficient. In this session, our expert speaker, in conversation with our moderator, looks into a real-world journey of adopting a Zero Trust security framework. Join us to explore the challenges, strategies, and successes encountered during a comprehensive transition from a legacy security posture to a robust, policy-driven Zero Trust architecture. . • What were the compelling reasons and business drivers that necessitated a shift to Zero Trust? • How did network segmentation, IAM, and device trust change during this process? • What are the common pitfalls? And how can new technologies and organisational change be managed and integrated? . – Moderator: Dominic Grunden, CISO, Power and Water Corporation – Chris Grisdale, CISO, hipages Group . |
|
14:40Networking Break |
|
15:10 The most sophisticated security stack is ineffective without the human intelligence to drive it. In this session, we discuss the acute cyber security skills gap by shifting the focus from external recruitment to internal talent evolution. We will explore how security leaders can build resilient, high-performing teams by implementing structured upskilling and cross-skilling programmes. . • Build a roadmap for transitioning IT generalists into specialised security roles, reducing reliance on a volatile hiring market. • Identify transferable skills within IT and DevOps teams to create robust internal security pipelines • See how investing in continuous professional development reduces long-term recruitment costs and “brain drain” • Build a “security-first” mindset across the organisation through collaborative and inclusive cross-training initiatives . – Marco Figueroa, Senior Manager, Cyber Security, Risk and Compliance, Australian Institute of Company Directors . |
|
15:40 Your security is only as strong as your least-secure vendor. With supply chain attacks surging, organizations can no longer afford to treat third-party risk management as a static, check-the-box compliance exercise. In this session, our expert speaker delivers a pragmatic, risk-based framework for identifying, prioritizing, and mitigating vulnerabilities across your entire software and vendor supply chain. We will explore how to move away from exhausting, one-size-fits-all security questionnaires and shift toward continuous, automated threat monitoring. . • Discover how to categorize vendors by data access and business impact, allowing your team to focus critical security resources where they matter most • Learn how to implement continuous security posture tracking to catch vendor drift and emerging supply chain vulnerabilities in real time • Practical methods for embedding enforceable security baselines into vendor agreements and establishing clear incident response protocols for third-party failures . – Jihad Zein, Global Head of Governance, Risk and Assurance, Group IT, Toll Group . |
|
16:10Closing Remarks by the Chair: Gaurav Vikash, Head of Security and Risk – APAC, Axon |
|
16:20End of Conference |
