CISO Critical Infrastructure Melbourne schedule

During this 10-minute networking session, the aim of the game is to go and meet three people you don't already know. Use the questions on the screen to guide your conversation. Have fun!

Australia’s critical infrastructure is under sustained pressure - from increasingly sophisticated AI-enabled attacks to cascading risks across supply chains, and not to mention natural disasters. This is a call to action: How do we rapidly build real-world cyber-capability, not just policy? Explore the ways C-Suite leaders move beyond minimum compliance to invest in long-term operational resilience across critical infrastructure. Where are your capability gaps, and what happens now to secure Australia’s future?

• Integrate advanced threat detection and automation into existing infrastructure.
• Build trust and transparency with stakeholders through secure-by-design strategies.
• Reduce risk exposure with proactive monitoring and predictive intelligence. 

As PSPF obligations tighten and SOCI reforms deepen, critical infrastructure operators face growing pressure not only to comply but to prove the strength and maturity of their security practices. This keynote explores how to assess, strengthen, and sustain compliance confidence while embedding resilience across systems, people, and processes.

• Assess your current posture and understand where your capabilities lie, whether you’ve crossed the compliance threshold, and where the biggest uplift opportunities remain.
• Clarify the regulatory landscape: unpack how PSPF, SOCI, CIRMP, and emerging cyber rules overlap, and what they mean for executive accountability and governance.
• Link ownership to accountability to explore the “if I can touch it, I can own it” mindset to strengthen control over assets, systems, and risk exposure.
• Build a practical roadmaps that translates regulatory requirements into stronger, more adaptive security and operational continuity.

Moderator:
Prof. Abbi Sharma Chief Digital and Transformation Officer Victorian Government 

Panellists

Richard Magalad IRAP Assessor Australian Government

Anthony Canning Chief Information Security Officer 5G Networks 

• Identifying high-risk dependencies and vulnerabilities across your supply chain.
• Strengthening oversight and accountability through better risk frameworks and due diligence.
• Embedding cyber resilience into procurement, contracts, and third-party management processes.
• Applying proactive measures to contain and mitigate threats before they escalate.

Critical infrastructure faces a sharp rise in blended cyber threats. Nation-states increasingly rely on cybercriminal groups to gain access, scale operations, and mask attribution. These campaigns now target OT and ICS environments directly, aiming to disrupt safety, availability, and trust.

This session sets the threat context and aligns it to the Australian Signals Directorate CI Fortify guidance, focusing on practical defensive outcomes rather than theory. The session explains how static and behavioural AI on the endpoint detects malicious activity in OT and ICS systems, even when traditional controls fail. It covers how endpoints continue to prevent, detect, and respond when fully disconnected from the cloud.

Attendees will see how air gapped endpoint security maintains protection, visibility, and service availability in isolated or degraded environments. The session closes with a reference to security architectures and deployment models for critical infrastructure. These patterns support connected, partially connected, and fully air-gapped environments. The goal is clear: deployable guidance for protecting endpoints where uptime, safety, and resilience matter most.

As global volatility intensifies, the stability of critical infrastructure supply chains is increasingly threatened by geopolitical destabilisations, concentrated vendors, and just-in-time models. Efficiency gains have come at the expense of resilience. This session explores how to safeguard essential services amid escalating disruption and regulatory pressure.

• Reassess procurement models to balance cost, resilience, and compliance while avoiding diminishing security returns.
• Collaborate with regulators and partners to strengthen transparency and oversight across volatile supply ecosystems.
• Evaluate geopolitical flashpoints and destabilisations to understand their cascading impacts on Australia’s critical infrastructure.
• Embed resilience into design, planning, and vendor management to withstand future shocks and disruptions.

Moderator

Daisy Wong Head of Security Awareness Medibank

Panellists

Helaine Leggat Non-Executive Director CI-ISAC

John Ellis Global Head of Security, Trust and Influence QBE Insurance

Vasant Prabhu Global Data Protection Lead (AI, Privacy and Cybersecurity Architecture) Toll Group  

As AI reshapes threat detection, decision-making, and operational oversight, critical infrastructure leaders face a new challenge - how to harness automation without amplifying risk. This session explores how to embed AI responsibly into security and resilience frameworks.

• Leverage AI-driven analytics to detect, respond, and recover faster from complex threats.
• Integrate human oversight to ensure accountability and trust in automated systems.
• Balance innovation with compliance as AI regulations and ethical standards evolve.
• Build assurance frameworks that validate AI performance and mitigate model driven risk. 

• Identify and continuously monitor assets, protocols, and interdependencies across hybrid environments.
• Align cyber security, operations, and engineering around shared OT security goals.
• Continuously monitor assets, protocols, and interdependence across hybrid environments.

Moderator

Nathan Morelli Head of Cyber Security and IT Resilience (CISO) SA Power Networks 

Speakers
David Worthington General Manager - Digital Security and Risk Jemena

Luke Ma Head of Technology Controls and Governance AIA Australia 

AI agents and service accounts are exploding across SaaS and cloud, creating a hidden attack surface that traditional security controls can’t see.

In this presentation, we’ll unpack why non-human identities and the secrets they hold are now the fastest-growing risk in enterprise environments. Learn how attackers exploit privilege sprawl, API keys, shadow AI, and why regulators are demanding demonstrable controls under various frameworks. Our expert will share insights to expose hidden security risks with AI agents, unveil the visibility gap, and provide a practical guide to employ control on escalation paths whilst staying operationally efficient.

You’ll see how BeyondTrust’s privilege-centric identity security delivers visibility, intelligence and protection across hybrid and multi-cloud environments. Walk away with a blueprint for securing agentic AI and non-human identities so your organisation can innovate confidently, comply continuously, and stay resilient in 2026 and beyond.

Modernising these assets requires a careful balance between commercial imperatives, operational continuity, and security assurance. This session explores how critical infrastructure operators can innovate with precision—protecting what matters while unlocking new value.

• Assess asset management practices to identify risk, commercial value, and tangible pathways to secure modernisation.
• Protect ageing OT systems that are increasingly connected yet remain essential to operations.
• Mitigate cyber-physical vulnerabilities arising from greater integration, visibility, and remote access.
• Integrate old and new technologies through phased strategies that minimise disruption and sustain resilience.

Panellists

Bilal Baig Senior OT Digital Security Specialist Coles Group

Faysal Hasan Senior Cyber Sec Analyst - OPS Lead Viva Energy
Moe Nahas Manager - OT Infrastructure Ports Victoria

Critical infrastructure operators are judged not on policy, but on performance when services are under pressure. As digital systems, third-party dependencies and AI increasingly underpin essential services, traditional compliance models struggle to keep pace.

Static documents and periodic audits create gaps between how systems are governed on paper and how they behave in reality.

This session examines service-level accountability, tolerance thresholds, proportional oversight, and the shift from point-in-time reporting to continuous confidence; making assurance incident-ready, not just audit-ready.

• Understand why IT and OT view risk differently and how to align their priorities.
• Make traditional IT frameworks practical and effective for operational environments.
• Create collaboration models that unite IT and OT for resilient operations.

• Prioritise investments that deliver the highest maturity uplift per dollar.
• Embed resilience into maturity roadmaps to ensure operational continuity.
• Building intelligent vulnerability management security controls.
• Develop leadership buy-in for long-term maturity investments.

Speakers

Rucha Gatti Director, Tech and Info Risk NAB

Daisy Wong Head of Security Awareness Medibank

• Aligning budget, training, and leadership priorities for security.
• Practical examples of industry-wide safety/security initiatives.
• Showcasing long-term cultural impact on resilience. 

• Encouraging early reporting without blame: frameworks that support trust and action.
• Detecting high-risk behaviours before they escalate.
• Aligning security, and compliance functions to respond effectively.
• Meeting legal and regulatory requirements for insider threat programs in critical sectors.

Operational Technology (OT) environments, which are critical to industrial, manufacturing, and infrastructure functions, are rapidly emerging as the premier target for sophisticated cyber adversaries.

This presentation analyzes this year’s critical pivot observed in both hacktivist and financially motivated ransomware groups, detailing their evolution from traditional Information Technology (IT) targeting to more advanced OT compromises. We will explore the primary driving forces behind this shift and its consequences.

• Take a journey through the evolution of OT and their major leaps in architecture and innovation.
• What is next on the horizon and what risks do they pose?
• Navigating OT innovation risk using ACSC’s Principles of OT Cybersecurity and CI Fortify, and INL’s Cyber Informed Engineering.
• Building defensible and ‘survivable’ OT architectures

• Move from reactive recovery to proactive, adaptive continuity planning.
• Identify and mitigate operational risks before they escalate into crises.
• Design business continuity plans that integrate cyber, physical, and supply chain resilience.

This candid closing discussion brings together senior executives, CISOs, and government leaders to reflect on the day’s biggest insights - and what they’re taking back to the boardroom.

• How are you aligning security with business outcomes and operational risk?
• What’s your top priority for the next 90 days?
• What role should government, industry, and the boardroom each play?

Moderator

Tara Dharnikota Chief Information Security Officer Victoria University

Speakers

Huon Curtis Head of External Affairs CI-ISAC  

Pearse Courtney Principal Sector Engagement ex-AEMO