Agenda

Breakfast networking and registration 

Chairman's Welcome

►Yesterday’s Playbook, Tomorrow’s Threats: How the Hugging Face incident changes our view on Cybersecurity

Pieter Siedsma, Tribe Lead – Cyber Assurance, Global Information Security, HEINEKEN International B.V.

• Are We Defending the Wrong Things? How open AI ecosystems challenge established assumptions about attack surfaces, trust boundaries and what we actually need to secure.
• Has the Balance of Power Fundamentally Shifted? Whether traditional advantages in detection, intelligence and defence can survive an era of rapidly evolving, accessible AI capabilities.
• What Does the Next Security Playbook Look Like? How should we look at the AI Loop and the human involvement with that loop? And what does this mean for our playbooks?

►The Intelligence Gap: Why Modern SOCs Depend on Complete Internet Visibility

Jonas Gyllenhammar, Senior Solutions Engineer, Censys

• Security Operations Centers (SOCs) are expected to detect, investigate, and respond to threats faster than ever before. Yet many SOC workflows still rely on incomplete, outdated, or fragmented views of the internet-facing assets, infrastructure, and adversary activity that shape today's threat landscape. 
• This intelligence gap can lead to longer investigations, missed detection opportunities, inaccurate risk assessments, and slower response times. Whether SOC processes are analyst-driven, highly automated, or augmented with AI, the quality of outcomes depends on the quality of the underlying intelligence.
• This presentation explores why fresh, complete Internet Intelligence has become a foundational requirement for modern SOCs.

►In the Cyber Trenches: War Stories from 300,000 pentests — Legacy Defence Misses the Modern Threat

Matt Percival, Regional VP of Sales, Horizon3.ai

• To defeat the adversary, we must move beyond tracking their tools: we must understand their mind.
• The traditional approach to cybersecurity has focused relentlessly on the technical what (malware signatures, TTPs) and the macro why (geopolitical tension, economic drivers). However, the next decisive frontier in intelligence and defence requires a pivot to the who: the personality dynamics that fuel cyber threat actor groups and using autonomous tools to follow in their footsteps.
• Assume less; validate more. Security teams can miss obvious weaknesses when they focus on the wrong signals. The answer is to prove security through realistic attack paths not simply declare an environment secure.
• Think like the attacker. Effective defence requires understanding both how attackers operate and what motivates them from status-seeking and manipulation to thrill-seeking behaviour.
• Turn attacker perspective into continuous action. Autonomous pentesting can emulate adversary behaviour at scale, uncover verified attack paths, and provide evidence of impact so organisations can continuously find, fix and verify exposure.

►OT/IT Cybersecurity Alignment: Challenges, Risks, and Lessons Learned

Alireza Saadiani, Chief Information Security Officer (CISO), Allego

• Identifying the most common challenges in aligning OT and IT cybersecurity, including legacy systems, visibility gaps, and operational constraints.
• Learn practical approaches to improve collaboration between OT and IT teams while maintaining business continuity and safety.
• Discover best practices for reducing cyber risk in industrial and critical infrastructure environments through governance, segmentation, monitoring, and incident response.

Networking Break

►Fireside Chat: Navigating the Ripple Effect: How New Cyber Regulations Shape Corporate Strategy

Simon Brady, Event Chairman
Barbara Pires, Chief Information Security Officer, Booking Holdings Financial Services

• Understand how emerging cyber regulations reshape enterprise risk appetite, investment priorities, operating models, and board-level decision-making.
• Explore how regulatory change extends beyond compliance—affecting supply chains, third-party risk, incident response, resilience, M&A, and competitive positioning.
• Identify how leading organizations can move from reactive compliance to proactive cyber governance, using regulation as a catalyst for resilience, trust, and strategic differentiation.

►Presentation to be Confirmed

Speaker to be Confirmed, Rubrik

►Identity in the Age of Agents

Chris Dearden, Lead Sales Engineer, Delinea

• Every insider threat programme ever built assumes intent. AI agents have none — and they are already inside your environment, running on credentials nobody deliberately issued them.
• This session works through three real incidents: an agent that deleted a database in a development environment, one that deleted a production environment at a major cloud provider, and one where models under evaluation escaped their sandbox and reached a third party's production estate — an incident that took 73 days to attribute, and which the victim disclosed before the attacker knew it was the attacker. 
• No adversary in any of the three. No prompt injection. The only variable that moves between them is how far the credentials reached.
• We will walk the full chain of controls — model guardrails, sandboxes, MCP gateways, inventory — look honestly at what routes around each one, and finish on what it would take to hold a cloud-hosted agent to the same standard as one running on your own infrastructure: that it cannot reach your data at all without passing something able to say no.

►Presentation to be Confirmed

Speaker to be Confirmed, ThreatLocker

Lunch and Networking 

►Preparing for the quantum era: Lessons from Rabobank’s PQC journey

Herbert Leenstra, Security Architect, Rabobank

• How to take the first practical steps toward cryptographic agility.
• Key lessons learned from Rabobank’s implementation journey.
• How to build executive buy-in and justify investments in PQC

►Unmasking Fraud: The Lifecycle and Operational Dynamics of Identity Deception

Marcin Zimny, Senior Principal Solution Engineer, Ping Identity

• Fraud rarely begins and ends with a single stolen credential. 
• Identity deception can unfold across an interconnected lifecycle from the creation or compromise of identities to account takeover, abuse, and attempts to evade detection. 
• In this session, Marcin Zimny will explore how these tactics operate in practice, why they are difficult to spot in isolation, and what organisations can do to strengthen their response. 
• Attendees will leave with a clearer view of the signals, controls, and cross-team coordination needed to detect identity-led fraud earlier and protect trusted digital interactions.

►Anti-Heroes! Why AI Goes Rogue

Michael Adjei, Director, Systems Engineering, EMEA, Illumio

• We are now in the agentic AI era, but what happens when your supposedly trusted agent turns rogue? Why does that even happen? And more importantly, could your organisation be the next victim?
• The misalignment of increasingly capable AI models continues to be a big challenge for the major AI vendors.
• This means that the consumer organisations who are using these models could potentially be harbouring dangerous rogue agents deep inside their corporate networks — and the risk becomes more evident with each new reported frontier release.
• So, in this session, Michael Adjei, Director of Systems Engineering at the breach containment company, Illumio, will take attendees through the principles of: why AI agents go rogue; how rogue AI is amplifying existing foundational cyber problems; what it means for cyber and business resilience; and rethinking defence in-depth for this new agentic AI era.

►Rise of Autonomous Attacks (Live Mythos-Style Hack)

Manit Sahib, Ethical Hacker & Former Head of Penetration Testing & Red Teaming, Bank of England

• See how autonomous AI agents are now running the recon and exploitation phases of real-world attacks. and what that means for boards, CISOs, and red teams in 2026.
• A first-hand look at how agentic offensive AI works in practice, driven by intent, not step-by-step instruction.
• See AI agent run reconnaissance against a controlled target, identify exploitable assets, and demonstrate the early stages of a kill chain in real time.
• A walk through real-world findings from recent engagements including critical vulnerabilities discovered by AI agents that automated scanners had missed for over 18 years.
• What defenders need to know: why traditional, control-based security models are structurally insufficient against goal-driven autonomous attackers, and the three specific actions every CISO should be taking before this becomes the default attacker model.

Networking Break

►Panel Discussion: Beyond Compliance — From Regulation to Resilience

Simon Brady, Event Chairman (Moderater)
Lalit Bhakuni, Senior Leader Cyber Defense, ABN AMRO Bank
Eleonora Petridou, CISO, RIPE NCC
Stevan Bias, Business Information Security Officer, Booking.com
Kaoter El Bouhmi, Cyber Security Officer for Civile Constructies, City of Amsterdam
Pieter Siedsma, Tribe Lead – Cyber Assurance, Global Information Security, HEINEKEN International B.V.

• What has changed your organisation with NIS2, DORA or the CER Directive, and what lessons have you learned from implementation?
• Which metrics or indicators do you use to demonstrate cyber resilience to your board and regulators and which have you stopped using because they don't drive better decisions?
• How are you preparing for the next wave of cyber regulation and emerging threats?

Chairman's Closing Remarks