25 Years of Cybersecurity and it’s only getting harder. Security is not just defence, it’s resilience and, increasingly, offence. But what if traditional security is not just insufficient? What if it is truly obsolete?

Twenty-five years ago, we convened the first e-Crime and Cybersecurity Congress to discuss a niche concern called "e-Crime."

Today, cybersecurity has moved from teenage bedrooms to FTSE100 boardrooms. For adversaries, it’s an economic powerhouse and a fully developed tool in the armoury of political interference. For defenders, it’s also a core business imperative, a geopolitical challenge, and a defining conflict in what has become a new, fully digital age.

The Evolution and The Revolution
Over two decades, the industry shifted from simple e-Crime to deeply technical exploits, and has now come full circle. We are back to battling digitally enabled fraud, ransomware, and theft — but the stakes have never been higher. We will honour the champions of the past, but our focus is firmly on the future.

The New Paradigm: Security, Resilience, and Offence
We are entering an entirely new era driven by Artificial Intelligence. AI is not just a tool for defence; it is a force multiplier for attackers, capable of generating novel malware and destroying old notions of identity just when identity itself had become the new perimeter. To survive this era, we must abandon the old "prevent and detect" mindset.

We are now operating in a tripartite world in which CISOs need defensive and protective security,  resilience mechanisms that can mitigate the inevitable and allow the organisation to operate while in recovery and also offensive security to prevent and fight back. Is it time to accept that attack really can be the best form of defence?

But underpinning these well-known truths is an uncomfortable question. Are the disciplines, technologies, people, and skillsets built for an analogue world that became digital still fit for purpose in a world utterly dependent on the digital ecosystem?

Has breakneck digitalisation of everything, plus AI, broken the assumptions that made the old playbook work so badly that we need to tear it up and start again? Or are current structures redeemable?

Cybersecurity has been here before of course. The internet, cloud, mobile, and ransomware each felt like a reset. They changed the threat model, the economics, and the tooling — but they didn’t invalidate first principles like identity, patching, least privilege, segmentation, logging, backup, and incident response. AI is the same kind of shift, only faster and more pervasive.

Why You Should Attend
We are going to do two things at this very special 25th Anniversary Congress. We are going to look back and celebrate your achievements over the past two decades and see what lessons we have learnt as an industry.

But we are also going to take a cutting-edge look at the future to give you, the delegate, the strategic roadmap required to navigate this new reality.

This isn’t simply the likes of AI literacy, identity-first security, supply chain resilience and Cloud and SaaS expertise — these are just table stakes. You need to be able to properly understand cyber-economics, the link between the geopolitical and your core operations, the proper economic balance between compliance and security, and how to ethically employ offensive tactics to protect your organization.

Join us for a landmark event as we celebrate our 25th Anniversary — a milestone that invites us to look back at the visionaries who built this industry, and to look forward at a landscape that has changed beyond all recognition.

Key Themes: AI and Quantum

25 Years of cyber: from e-Crime to AI
A quarter-century ago, e-Crime was a niche concern. Today, it has evolved through deeply technical exploits and returned to digitally enabled fraud, ransomware, and theft — now supercharged by AI. Who are the champions who built our industry and how does our shared history shapes tomorrows’ strategy?

Resilience by design: surviving the inevitable
Assume breach. Assume ransomware. Assume outage. Resilience is no longer a backup plan; it is a design principle. But it affects everything: architecture, immutable backups, zero-trust recovery, crisis simulation, and business continuity. So, what are the material lessons learnt from major incidents, and how can organisations achieve anything close to real operational resilience?

Regulation and compliance: the global patchwork
NIS2, DORA, SEC rules, GDPR, and emerging AI Acts are reshaping accountability. But global regulation is a patchwork, and compliance does not equal security. This theme maps the regulatory landscape, explores board-level liability, and debates whether law can keep pace with technology. How can organisations turn compliance into competitive advantage and how should they prepare for the next wave of mandatory reporting.

Cloud, OT, and Critical National Infrastructure
The convergence of IT, OT, and cloud is expanding the attack surface into power grids, hospitals, factories, and transport. This has purely security implications: securing hybrid environments, legacy OT, and cloud-native architectures. But it also involves CISOs in nation-state threats and the unique resilience demands of critical infrastructure (and their third-parties). How does security need to evolve so that we are all protecting the systems society depends on?

The cyber workforce and talent crisis
We have a skills gap, a burnout crisis, and a diversity problem. This theme tackles recruitment, retention, neurodiversity, career pathways, and the rise of AI copilots in the SOC. We’ll explore how to build high-performing teams, reduce alert fatigue, and create a culture where security professionals can thrive.

From SOC to Board: real metrics, ROI, and cyber economics
Security leaders must speak the language of business. This theme connects boardroom strategy to SOC operations: risk quantification, cyber ROI, insurance, budgeting, and reporting. So, how can security leaders measure what matters, justify investment in resilience and offence, and communicate risk without fear-mongering?

Quantum-proofing the enterprise: crypto agility before the deadline
The quantum threat is not a 2035 problem. Adversaries are stealing encrypted data today to decrypt it later, and most organisations cannot say where their cryptography lives, let alone migrate it. This theme covers cryptographic discovery, NIST post-quantum standards, crypto-agility architecture and the uncomfortable truth that hardware security modules and legacy libraries are not ready. What do CISOs need to do now and with what technology?

Offensive cyber: hack-back, deterrence and the legal grey zone
Offensive security has left the lab and entered the vendorscape and the boardroom. Governments are drafting frameworks for licensed private-sector operations, security firms are building disruption units, and legal protections for hack-back are being actively debated. But misattribution, collateral damage, and escalation are real risks with real precedents. So what are the rules of engagement, the accreditation question and the ethics of striking first?

Data privacy in the AI era: the techniques that actually work
Most privacy-and-AI content is governance theatre. What really matters is the detail: the cryptography and systems research genuinely changing what is possible; ethical gradient masking that cuts PII leakage without destroying model utility; compressed-sensing federated learning; oblivious message retrieval; confidential computing and privacy-enhancing technologies in production. What’s the latest in thinking? What’s the latest risk mitigating technology?

Deepfake identity and the collapse of visual trust
Deepfakes are no longer a content moderation problem. They are identity fraud infrastructure. Biometric verification, video onboarding and voice authentication are under active attack, and regulation trails the technology by years. The defensive stack is part tech part smart interaction: liveness detection, content provenance, watermarking, verification protocols. But can biometrics survive as an authentication factor? If not, what does that mean for fraud, identity, and detection vendors, and for every delegate who still trusts a face on a screen?

Agent as endpoint: runtime defence for autonomous systems
Prevention has failed before the agent starts work. Security teams need to focus on runtime: memory integrity firewalls, context provenance, cross-model verification, capability sandboxing and ephemeral least-privilege access for non-human identities. How are security teams getting on top of these new challenges as the business races ahead?

Confidential computing: running AI on data you cannot expose
Encryption protects data at rest and in transit. Confidential computing protects it while it is being used — hardware-isolated execution with cryptographic attestation, so model builders, data owners, and infrastructure operators each enforce policy on their own assets. CISOs need to ensure they have built trusted execution environments, multi-GPU attestation, and key management across trust domains. How can they do that quickly and cost-effectively?

Provenance for the AI supply chain
You cannot scan a model for malware before running it. You find out when you execute it. The consequences are complex: model signing, attestation chains, AI bills of materials, transparency logs, and verification gates at model-pull time — plus the post-quantum signature migration that must happen before these attestations expire. How does this affect supply chain, platform and PKI teams, and vendors building the trust infrastructure for AI?