Cybersecurity Leadership & Enterprise Risk

Chairpersons welcome and opening remarks

Security leaders are increasingly expected to justify decisions in financial and business terms rather than technical ones. This session offers practical frameworks for quantifying cyber risk in a way that resonates with non-technical board members, helping bridge the gap between security priorities and boardroom decision-making. 

Senior security leaders discuss how the CISO role has shifted from technical oversight to a strategic seat at the executive table. The panel explores what this means in practice, from renegotiating reporting lines and budget ownership to earning a genuine voice in board-level strategy, and shares candid views on where the role is still evolving.

Annual training modules rarely change behaviour on their own. This session looks at why traditional security awareness programmes often fail to stick, and shares real examples of how leading organisations are embedding security thinking into everyday workflows, incentives and decision-making rather than treating it as a once-a-year compliance exercise. 

Shifting geopolitical tensions, sanctions regimes and state-sponsored activity are changing how enterprises need to think about threat modelling. This session examines how global instability is reshaping risk prioritisation, and what security leaders should be factoring into their planning as the line between geopolitics and cybersecurity continues to blur.

A candid, one-on-one conversation with a security leader who has personally managed a major incident from the inside. The discussion covers the decisions made under pressure, the internal and external communications challenges, and the lessons that only become clear once the dust of the first 72 hours has settled.

High-pressure security roles carry a real human cost, and burnout is increasingly recognised as a genuine operational risk rather than just a wellbeing concern. This session explores practical, evidence-based steps leaders can take to build sustainable teams that can absorb pressure without breaking, and what that means for retention and performance.

Modern enterprises depend on sprawling networks of vendors, partners and suppliers, most of which sit outside direct security oversight. This session shares practical approaches to assessing, monitoring and managing third-party risk at scale, without grinding procurement and onboarding to a halt in the process.

Risk appetite statements too often end up as vague documents that sit unused. This session presents a practical model for defining, documenting and communicating risk appetite in a way that genuinely informs day-to-day decisions, helping teams make faster, more consistent calls without constantly escalating to leadership.

With the UK’s Cyber Security and Resilience Bill approaching Royal Assent, NIS2 obligations still bedding in unevenly across EU member states, and DORA supervision now shifting from awareness to active enforcement, security leaders face a genuinely crowded regulatory calendar. This panel brings together legal, compliance and security leaders to unpack what’s actually changing, where UK and EU regimes overlap and diverge, and how organisations operating across both should be prioritising their compliance efforts.

The cybersecurity skills shortage shows no sign of easing, and traditional recruitment routes alone won’t close the gap. This session explores new approaches to widening the talent pool, from apprenticeships and career-changer programmes to building genuinely sustainable pipelines that reflect a broader range of backgrounds and experience.

An honest, informal conversation about the realities of stepping into the CISO seat. The discussion covers the unspoken expectations of the role, early mistakes that are rarely talked about publicly, and the practical wisdom that only comes from having navigated the transition first-hand.

Many risk registers exist primarily to satisfy audit and compliance requirements, rarely informing real decisions. This session looks at how to move beyond static documentation towards risk registers that are genuinely used to prioritise action, allocate resource and drive meaningful conversations with the wider business.