Agenda

Breakfast networking and registration 

Chairman's Welcome

►Ready to Recover: The True Test of Cyber Resilience

Andy Giles, Executive Director, Cyber & Technology Risk Reporting and Metrics, JPMorgan Chase

• How the threat has changed — the rise of state-based and hybrid cyber activity, and the deteriorating threat environment.
• Prepare to fail — why resilience incidents are not hypothetical but inevitable, and why readiness must be cultural, not procedural.
• Match fit for recovery — what it means to be ready for data and systems restoration under real-world conditions.
• Knowing when “good enough” is good enough — how to measure resilience in ways that are predictive, embedded, and aligned with risk appetite.
   

►The 3 AM test — why security outcomes are decided by the operating model rather than the tool stack.

Dustin Schwinning, Senior Sales Executive, OpenSystems

• What is actually true about your controls at three in the morning on a Sunday.
• Run versus Reduce — the one ratio that predicts your next budget round, how to measure it from your own ticket data, and how to frame it so the board funds it.
• Four operating models, four failure modes — an honest comparison of in-house, self-run platform, managed wrapper and native managed, including where each one breaks and what it costs.
• Where incidents actually get long — the four handoffs that consume most of your MTTR, and why counting them in your own post-incident reviews changes the conversation.
• Six questions for your next RFP — practical wording to separate an operating model from a support contract, to be asked of every supplier, including Open Systems.

►Two Sides of the Table: What Two Former Practitioners See Coming for Enterprise Data

Chris Girling, Partner, Cybersecurity & Privacy, PwC Switzerland, Ash Hunt, VP of Strategy, Cyera

• Two speakers who ran security inside large enterprises before moving to advisory and product roles — why they made the move, and what it revealed about how enterprise environments are really changing.
• Finding the sensitive data: the best approaches they have seen work at genuine enterprise scale, including lessons from a major financial services programme, and the ones that quietly fail.
• Refactoring the enterprise: how control architecture is being rebuilt, what that does to legacy processes, and where the platform consolidation is heading.
• AI threats and risks: what is new, what is recycled, and what practitioners should be doing about it now rather than in two years.

►Real-World Tactics for Addressing AI Security Risks: Actions You Can Implement Now

Klaus Haller, Senior IT Security Architect, AXA

• Cutting Through the Noise: Industry hype and vendor fear-mongering versus AI security threats demanding genuine action.
• Targeted Risk Assessment: Exploring the various AI types and the unique security vulnerabilities they introduce.
• Practical Defenses & Future Challenges: Uncovering effective mitigation strategies and identifying AI security risks the industry is still learning to tackle.

► Education Seminar 1

Delegates will be able to choose from a range of topics:

• What Operating Model Are You Actually Running? A Working Session, Dustin Schwinning, Senior Sales Executive, OpenSystems
• From Identity Silos to Security at Scale, Christian Götz, Director SE Programs, Palo Alto Networks

Networking Break

►Quantum Is Coming. Financial Services Can’t Afford to Wait

Will Collison, Technical Director - Cryptography, HSBC

• Discover why the quantum threat to today’s cryptography is closer and more disruptive than many realise
• Hear what’s at stake for financial services as quantum computing reshapes the cybersecurity landscape
• Join the call for industry-wide collaboration to tackle one of cybersecurity’s biggest ever challenges before the clock runs out
• Learn what you can do today (or already should be doing) to reduce your risk

►Resilience for Everything: How to Ensure Business Continuity Across Cloud, Identity, and AI

Cédric Blöchlinger, Sales Engineer, Rubrik  

• Ensure recoverable backups for on-premises, cloud, and SaaS data
• Protect, analyze, and restore identity systems—from AD to Entra ID and Okta
• Accelerate AI transformation while maintaining control and rolling back when necessary

►Cyber Crime Unmasked: How Hackers Make Money (and how to stop them)

 Alex Hitchen, Sales Engineer, Huntress

• Alex Hitchen goes undercover into the modern cyber crime economy, pulling back the curtain on how attackers really operate, and how you can shut them down before they cash out.
• You’ll follow the money trail from that first “harmless” phishing email through Business Email Compromise (BEC), session token theft and Ransomware‑as‑a‑Service.
• Along the way, Alex will decode the roles of initial access brokers, affiliates and ransomware operators.
• This will include how the same playbooks that fuel their profits can be used against them with the right visibility and response.
   

►AI on Both Sides: How Attackers Scale, Defenders See, and Enterprises Stay in Control

Tom Kretzschmar, Sr. Sales Engineer, Proofpoint

• AI in the hands of attackers — what Proofpoint is seeing in the threat landscape today, where AI is genuinely changing attacks, and where the hype still exceeds reality.
• Seeing threats at global scale — how worldwide threat telemetry and intelligence turn billions of signals into early detection, connecting attacker infrastructure, identities, communications and campaigns.
• Securing AI inside the enterprise — how organisations can discover which AI tools and agents are being used, understand what data they access, and apply controls without standing in the way of adoption.

►Zero Trust Controls at the Endpoint

ThreatLocker

• Discover how ThreatLocker applies Zero Trust at the endpoint, eliminating implicit trust by continuously verifying every application, executable, and action before authorisation
• Learn how a deny-by-default, malware-proofing approach reduces ransomware risk, stopping unauthorised software and scripts even when other security layers are bypassed
• Understand how least-privilege enforcement limits attacker capability, ensuring applications and users can perform only explicitly approved actions on enterprise devices
• Explore how granular, policy-based endpoint control safeguards against modern threats, reducing enterprise exposure to ransomware and other advanced attacks

Lunch and Networking 

►Panel Discussion: Beyond Compliance — Building Cyber Resilience That Actually Works

Simon Brady, Event Chairman (Moderator)
Monika Atanasova, Global Head of Cyber TPRM, Raiffeisen Group
Philipp Grabher, CISO, Canton Zurich
Juan Carlos Lopez Ruggiero, Lecturer, HSLU, Lucerne

• How do we turn risk appetite statements into real decision levers instead of paperwork?
• With NIS2 and similar rules, what does “appropriate and proportionate” really mean on the ground — and how can risk management steer the response?
• Which cyber metrics really matter — and how do we prove our risk posture to the Board, to clients, and across the entire supply chain, right down to nth-party dependencies?
• How does a resilience-first mindset transform culture — moving from blame and unrealistic prevention to readiness, adaptability, and fast recovery?

►The AI ​​was granted access. No one saw what it did next

Andreas Muller, Regional Sales Director CEUR, Delinea

• Ensuring the use of AI creates genuine value rather than just risks.
• Why authorization alone isn't enough for agentic AI – and how Delinea StrongDM makes activity on critical systems visible in real time and controllable throughout the entire interaction.
•  Effective protection against ambiguous prompts or unwanted activities by both internal and third-party AI.

►Defining your Minimum Viable Company: lessons from cyber response

Johanna Peterson, Senior Manager, Cyber, Crisis and Resilience, and Jan Schulze, Manager, Cybersecurity, Resilience and Defence, PwC Switzerland

• Discover how organisations are unlocking the power of the Minimum Viable Company (MVC) to drive their resilience programmes: the critical products, services, and capabilities necessary to protect customers, revenue, and compliance during disruption.
• Learn real-world, hard-won lessons from cyber response that highlight the value of identifying your MVC before an attack, enabling faster and more effective recovery.
• Hear the no-regret actions and practical steps to engage your organisation on MVC, turning resilience planning into a shared organisational priority. 

► Education Seminar 2

Delegates are invited to attend:

• Securing the AI Workload: Defending Enterprise LLMs and Agentic Systems, Andrea Arquint, Principal Solutions Engineer, F5

Networking Break

►Panel Discussion: The Corporate Security Case for AI Sovereignty

Simon Brady, Event Chairman (Moderator)
Federico Casano, CISO, YAPEAL
Idir Laurent Khiar, DPO and AI Officer, Baltic Cluster, Geopost SA
Agnès Terreau, Country DPO & Security Officer, ManPower Group
Dr. Diana Coman Schmid, CISO, Canton of Glarus 
Antti Partanen, VP Security and CISO, Sunrise

• Your AI runs on someone else's infrastructure, under someone else's law — is that a security risk your board has signed off on?
• Do you actually know which AI models are running inside your organisation — and do you control what data they see and send out?
• NIS2, the AI Act, and GDPR each touch AI sovereignty differently — how do you build one coherent security programme when the regulations pull in different directions?
• If your primary AI vendor became inaccessible tomorrow — through outage, sanctions, or a geopolitical event — how long before your operations fail, and do you have a continuity plan?

►Rise of Autonomous Attacks (Live Mythos-Style Hack)

Manit Sahib, Ethical Hacker & Former Head of Penetration Testing & Red Teaming, Bank of England

• See how autonomous AI agents are now running the recon and exploitation phases of real-world attacks. and what that means for boards, CISOs, and red teams in 2026.
• A first-hand look at how agentic offensive AI works in practice, driven by intent, not step-by-step instruction.
• See AI agent run reconnaissance against a controlled target, identify exploitable assets, and demonstrate the early stages of a kill chain in real time.
• A walk through real-world findings from recent engagements including critical vulnerabilities discovered by AI agents that automated scanners had missed for over 18 years.
• What defenders need to know: why traditional, control-based security models are structurally insufficient against goal-driven autonomous attackers, and the three specific actions every CISO should be taking before this becomes the default attacker model.

Chairman's Closing Remarks

Drinks Reception & Networking, Kindly Sponsored by PwC Switzerland