Event Agenda

Under the UK Cyber Security and Resilience Bill, organisations across CNI, MSPs, and supply chains face increased regulatory oversight. The legislation introduces a mandatory two-stage incident reporting framework: an initial, light-touch notification to regulators and the NCSC within 24 hours of detecting a significant cyber incident, followed by a comprehensive submission within 72 hours. In this panel discussion, our expert security leaders will explore the implications of this compressed timeline.
.

• How can organisations reliably classify a “significant incident” or reportable “near miss” within hours of discovery without triggering unnecessary false alarms?
• What specific updates are required for technical detection workflows and board reporting playbooks to ensure compliance around the clock?
• How will these mandatory 24-hour windows reshape contractual obligations and incident-response expectations for MSPs and critical suppliers?

.
– Azeem Bashir, CISO, Apex Group Ltd
– Barbara Opala, Senior Technology & Cyber Security Lawyer, Wales & West Utilities
– Matt White, Cyber Advisory and App Security Director, Royal Mail
– Ian Dalby, Global Cyber GRC, A&O Shearman
– Christine Hall, Solutions Engineer, Forensics, Exterro
.

As the UK Cyber Security and Resilience Bill brings managed service providers and critical suppliers into direct scope, organisations must look beyond immediate incident reporting to long-term operational readiness. In this session, we explore how vendors, MSPs, and enterprise partners can build defensible security postures using the NCSC Cyber Assessment Framework. Learn how to streamline third-party risk management, eliminate supply chain visibility blind spots, and turn heightened regulatory standards into a commercial differentiator.
.

• Operationalise the NCSC Cyber Assessment Framework (CAF) to build continuous, demonstrable proof of security across supply chains
• Identify and mitigate critical third-party vulnerabilities before they escalate into reportable incidents
• Leverage proven compliance and robust supply chain controls to build trust and win enterprise contracts

.
.

Fraud and cyber security teams are better together, and we finally have the numbers to prove it. Drawing on The Convergence Dividend: Quantifying What Fraud-Cyber Convergence Actually Delivers, an empirical study of 250 fraud and risk decision-makers across five commerce verticals (Accertify + Liminal, 2026), this session puts a hard number on what convergence is worth. But not all convergence is created equal: the order in which organisations integrate fraud and cyber matters as much as whether they do it at all, and doing it in the right order is what separates organisations getting real performance gains from those that aren’t. Attendees will leave able to quantify the cost of staying siloed, with a convergence maturity framework they can bring back to their own organisations, and with a clear answer to why CISO-led fraud programmes underperform their peers… and what to do about it.
.
– Stuart Mann, Head of Industry Product Engagement, Accertify
.

As organisations race to integrate Generative AI, the boundary between innovation and risk has never been thinner. In this case study session, our expert speaker moves beyond theoretical frameworks to provide a candid look at how a leading enterprise successfully implemented its AI governance structure. We will explore the journey from managing “Shadow AI” to establishing a robust, scalable environment that prevents data leakage whilst empowering users.
.

• Learn how we moved from reactive AI bans to a proactive, risk-based governance model
• Hear practical techniques for monitoring and securing sensitive corporate data within third-party GenAI tools
• Define the roles of Security, Legal, and IT in building a sustainable AI Oversight Committee

.
– Spencer Scott, Global Head of Information Security, RPC
.

With many threats going under the radar, what you can’t see will hurt you. This session demonstrates how External Attack Surface Management (EASM) uncovers hidden vulnerabilities and shadow IT. Learn to think like a threat actor, identifying exposed digital assets and closing critical security gaps before they are exploited..

AI-generated video, voice, and identity spoofing have moved from headline curiosity to active enterprise threat. Attackers are cloning executive voices, fabricating video calls, and using synthetic identities to manipulate employees into transferring funds and exposing credentials. In this session, our expert speaker will
.

• See how deepfake attacks work in real enterprise environments in 2026
• Present employees with the signals they need to recognise a spoofed call, video, or identity
• Learn how to build deepfake awareness into an existing security training programme

.
– Senior Expert, Recorded Future

Modern organisations rely heavily on external vendors, making third-party risk management a critical pillar of overall cyber security. In this session, discover how to map your extended digital ecosystem, identify hidden vulnerabilities within vendor networks, and implement robust frameworks to safeguard sensitive data. Learn practical strategies to streamline supplier onboarding, continuously monitor third-party compliance, and mitigate supply chain disruptions before they impact your bottom line.

• • Master comprehensive vendor mapping to uncover blind spots across your entire supply chain network
  • Implement continuous third-party monitoring tools to proactively detect and remediate security posture changes
  • Align vendor risk frameworks with board-level metrics to secure stakeholder buy-in and drive accountability

.
– Darshan Mehta, Sr. VP Cyber Security Architect, JPMorgan Chase
.

Modern CISOs are expected to protect increasingly complex organisations while enabling growth, transformation, and speed. This session will explore how security leaders can move beyond technical risk management to become effective business leaders, translating cyber risk into commercial terms, helping organisations make informed risk decisions, and building resilience without becoming an obstacle to change.
.

• Balancing business velocity, resilience, and risk appetite
• Translating complex cyber issues into decisions that Boards and executives can act on
• Building security functions that enable transformation rather than constrain it
• Leading effectively through periods of uncertainty and sustained pressure

.
– Rob Newby, Global Head of Security Business Engagement, Marks and Spencer
.

Explore trends in AI usage over the past few years and understand which groups are adopting AI fastest, what types of data they are inputting, and what tools they are using, both sanctioned and unsanctioned. Then pivot to how to identify and protect against sensitive data being misused with AI tooling.
.
.

Even the most intelligent professionals frequently bypass security protocols, fall for sophisticated phishing scams, and make baffling cyber mistakes. This engaging session explores the fascinating intersection of behavioural science and cybersecurity, unpacking why human nature remains our greatest vulnerability. Discover how cognitive biases, workplace stress, and poor system design turn smart people into security liabilities. You will learn practical ways to design human-centric defences that work with—rather than against—our natural psychological tendencies.

• • Understand the cognitive biases and psychological triggers behind everyday irrational cyber security decisions
  • Learn how to design friction-free security policies and intuitive workflows that align with natural human behavior
  • Discover practical strategies to foster a positive, supportive security culture instead of relying on fear

.
– Matt White, Cyber Advisory and App Security Director, Royal Mail
.

T1: What Do We Do When Tech Fails?
.
T2: Are We Building Cloud Systems that are Too Fast to be Defended?
.
T3: Can We Secure Our Data in the GenAI Era?
– Senior Expert, Varonis
.
T4: How do We Scale Passwordless Authentication Across Legacy Systems that Lack Modern Identity Support?
.

The emergence of AI has reduced the barrier of entry and increased the capabilities of cybercriminals. This reality has made the implementation of Zero Trust essential. In this session, our expert speaker demonstrates how best to use Zero Trust solutions to prevent AI-boosted attacks from breaching your environment.
.

• See how AI has enhanced attacking capabilities, from amateurs to experts alike
• Learn why a Zero Trust model is the proactive way to stay ahead of AI-enabled threat actors
• Implement a straightforward framework to keep AI threats outside your environment

.
– Jean Carlos, Head of Information Security, Checkatrade.com
.

As AI capabilities accelerate, the means to defend our systems grows, but so does the ability for malicious actors to launch harmful attacks. This panel explores whether AI will secure our digital infrastructure or systematically dismantle it. Central to this debate is the recent development of Claude Mythos Preview, an unreleased frontier model that recently autonomously exposed over 10,000 high-severity vulnerabilities across critical software. Does this herald a revolution in cyber defence, or are there major concerns for what harm future AI-powered attacks will bring?
.

• What impact will models like Claude Mythos Preview have on traditional patch-management cycles?
• Is an entirely autonomous, self-healing software architecture coming in the future?
• If a ‘Mythos 1’ or similar open-source model falls into the hands of malicious actors, what does Day 1 of that reality look like for enterprise defence?
• Can we prevent these autonomous exploitation capabilities from proliferating to cybercriminals?

.
– Moderator: Nish Sukumaran, Vice-President, Information Security, Worley
– Punit Bafna, Head of Cyber Security and Compliance – Enterprise Transformation, Haleon
– Neil Weller, Group CISO, OCS Group UK
– Victor Shadare, Global Head of Cyber Security, Conde Nast Britain