CISO Critical Infrastructure Melbourne schedule

During this 10-minute networking session, the aim of the game is to go and meet three people you don't already know. Use the questions on the screen to guide your conversation. Have fun!

The question is no longer whether organisations will face cyber threats, but how effectively they can continue operating through disruption. As cyber incidents become increasingly impactful, we explore how security leaders must shift from a prevention-only mindset towards building resilience across people, processes and technology.

 As cloud adoption, remote access and interconnected infrastructure expand, identity has become the new security perimeter. We explore how organisations are strengthening access controls and reducing exposure across complex environments. 

The review of Australia’s critical infrastructure framework, alongside proposed amendments to streamline and modernise the SOCI Act, has highlighted the need for stronger coordination, transparency and resilience across essential services. With reforms addressing regulatory duplication, evolving asset coverage, AI-enabled cyber incidents, governance, assurance and supply chain security, organisations are under greater pressure to demonstrate resilience, not just regulatory compliance.
Has compliance become a catalyst for stronger security, or are organisations still treating it as a checklist exercise?

• Key implications of the SOCI review and proposed reforms for operators.
• Closing the gap between policy, compliance and practical implementation as regulatory expectations evolve.
• Strengthening governance, assurance and collaboration between government and industry.
• Preparing for emerging risks across AI, supply chains, new asset classes and increasingly complex threats.

Speakers:

Dr Jill Slay SmartSat Chair – Cybersecurity and Reviewer of the SOCI Act 2025 Adelaide University

Jonine Meadon SOCI Leader Energy Australia

Ramy Ibrahim Cyber Security Manager and Advisor Ports Victoria 

• Establishing governance frameworks to securely adopt AI across critical infrastructure.
• Protecting AI models, data and operational systems from emerging cyber threats.
• Balancing innovation with safety, resilience and regulatory expectations in high-risk environments.

• Using AI to improve threat detection, investigation and incident response.
• Staying ahead of AI-enabled attacks, automation and social engineering tactics.
• Reducing alert fatigue through smarter security operations.
• Balancing AI adoption with governance, oversight and responsible use. 

With thousands of alerts, evolving tactics and geopolitical instability, how can security leaders focus on the intelligence that matters most?

As threat actors become more sophisticated and globally connected, organisations must evolve how they consume intelligence, anticipate disruption and make strategic decisions that protect critical infrastructure.

• Identifying which global threats could translate into real operational impact for Australian critical infrastructure.
• Moving beyond reactive threat reporting towards proactive risk anticipation and preparedness.
• Bridging the gap between intelligence teams, security operations and executive decision-making.
• Building stronger intelligence capabilities to navigate uncertainty, disruption and emerging attack methods.

Speakers:

John Ellis Global Head of Security Trust and Influence QBE

Jen Stockwell Head of National Security and Geopolitical Risk Telstra

Huon Curtis Head of External Affairs CI-ISAC 

• Why endpoints remain a primary target for ransomware and advanced attacks
• Improving visibility across IT, OT and remote environments
• Leveraging behavioural analytics and AI-driven threat detection
• Balancing security, operational uptime and regulatory requirements 

Launching a critical infrastructure organisation is challenging. Building one under government oversight, intense public scrutiny and evolving regulatory requirements is another challenge entirely. In this keynote Riyan John Stephan shares lessons from a three-year journey of scaling a newly established organisation from startup mode to a mature, resilient operation. Discover how governance, security, technology and leadership were developed in parallel, the obstacles encountered along the way, and the practical lessons leaders can apply to their own transformation journeys.

Security teams are facing an expanding number of vulnerabilities, assets and potential entry points, making it increasingly difficult to determine what requires immediate attention. How are organisations shifting from vulnerability management to exposure management, focusing resources on the risks that create the greatest business impact? 

Cyber incidents affecting critical infrastructure are no longer hypothetical. How can executive teams make confident decisions when operational continuity, public safety and regulatory scrutiny collide?

Speakers

Brett Aimers Senior Manager - Emergency Critical Management Ausnet

Rhiannon Taylor Program Director Cyber Security Downer Group

Maria Paz CTO Epworth Healthcare 

As organisations become increasingly data-driven for advancing AI, protecting sensitive operational, customer and business data has become a strategic priority. How are leaders are securing data across increasingly complex environments? 

AI is rapidly becoming both a critical cybersecurity capability and a tool for increasingly sophisticated attackers. As organisations accelerate AI adoption, governance becomes essential to ensuring these technologies are deployed responsibly, securely, and with appropriate oversight. How can leaders harness AI to strengthen defence while establishing the governance frameworks, controls, and accountability needed to manage AI-enabled threats?

Moderator
Dan Haagman CEO Chaleit

Speakers

Daisy Wong Head of Cyber Awareness Medibank  

Jan Cutts Executive Manager - Cloud and Hybrid Infrastructure nbn Australia 

• Managing identity across hybrid and multi-cloud environments.
• Reducing excessive privileges and access risks.
• Securing third-party and contractor access.
• Improving visibility into identity risk.

As IT and OT environments become increasingly connected, cybersecurity decisions can directly influence operational outcomes. This panel examines how critical infrastructure organisations are creating clearer accountability models. Who has authority when security and operational priorities conflict?

You cannot secure what you cannot see. As OT environments become more complex, organisations must improve asset visibility, understand vulnerabilities and detect threats before they impact operations.

• Achieving complete OT asset visibility.
• Identifying unknown devices and vulnerabilities.
• Integrating OT monitoring with security operations.
• Building effective OT threat detection capabilities.

Many critical infrastructure operators rely on decades-old systems that were never designed with cybersecurity in mind. How can organisations modernise their security posture while maintaining the reliability and safety of essential services? 

Critical infrastructure organisations depend on complex networks of suppliers, vendors and technology partners. This keynote explores how leaders are improving third-party visibility and resilience in an increasingly interconnected ecosystem.

• Moving beyond compliance metrics to meaningful risk indicators.
• Communicating cyber risk effectively to executive stakeholders.
• Measuring resilience, response capability and security maturity.
• Aligning cybersecurity investment with organisational priorities.

Cyber resilience is tested not when everything is working, but when organisations face uncertainty, pressure and disruption. This candid discussion brings together CISOs and senior leaders to reflect on the biggest challenges shaping cyber readiness, using live polling and audience insights to explore where organisations are prepared, where gaps remain and what needs to change.

You weigh in on:

• How prepared are organisations today for a major cyber disruption?
• Which areas remain the biggest barriers to resilience: technology, people, processes or governance?
• What lessons can leaders take from recent cyber incidents and industry experiences?
• Where should organisations prioritise investment to strengthen readiness for future threats?