Agenda
Wednesday, 13 May 2026
“Operational Resilience & Securing Autonomous Systems”
Please note that 1:1 meetings will be running throughout the day.
Registration & Check-In
Welcome to the 12th Security Edge: "Operational Resilience & Securing Autonomous Systems"
Jim Berry - CEO & Founder at ADAPT
With adversary breakout times now just 48 minutes, is your organisation resilient enough to survive inevitable compromise?
Join your peers at ADAPT Security Edge to connect, learn, and lead through the challenges of our rapidly shifting security landscape.
– Debating how to redesign security architectures for speed, effectively govern AI risks, secure autonomous systems, and govern agentic AI.
– Discuss what operational resilience looks like when you assume compromise rather than relying solely on prevention.
– Explores how critical infrastructure leaders are redesigning OT security for a world where downtime is a systemic business threat.
– Identify the specific strategic elements missing from current plans to secure generative and agentic AI systems within the enterprise.
Ultimately how to be brilliant at the basics and defend effectively with limited budgets.
What Are the Top Performers Doing Differently?
Gabby Fredkin - Head of Analytics & Insights at ADAPT
ADAPT’s Research and Advisory team reveal data-driven insights from 1,000+ regional surveys of Heads of IT, Digital, Security and Finance – leaders driving 60% of Australia’s GDP. Benchmark your security maturity, explore investment barriers, and validate CISO priorities against peers. Gabby distils core findings on security challenges, AI governance strategies, and data protection approaches delivering measurable outcomes in 2026’s evolving threat and compliance landscape.
Get an Edge: Making the Most of Your Day
Rachel Rock - Director of Executive Programs Engagement & Delegate Acquisition
Keynote Fireside Chat - A Day in the Life of a CISO
Sandro Bucchianeri - Chief Security Officer at NAB Adam Cartwright - CISO at Australia Post David Gee - ADAPT Advisor and Infuential CISO
In this keynote fireside chat, David sits down with two of Australia’s leading CISOs – Sandro Bucchianeri – Chief Security Officer at NAB, and Adam Cartwright – CISO at Australia Post.
Fittingly – and entirely by coincidence – Sandro and Adam are featured in David Gee’s best seller “A Day in the Life of a CISO”. During this engaging and interactive session, both leaders will share the pivotal moments, practical insights, and hard-earned lessons that have shaped their careers.
Key discussion highlights include:
– Adam Cartwright: How to defend effectively with limited budgets
– Sandro Bucchianeri: The power of being brilliant at the basics
This is a must-attend session for CISOs, cybersecurity practitioners, and emerging leaders seeking real-world guidance from two of the industry’s most respected voices.
Securing the New Enterprise AI Operating System
Chris Fisher - SE Director APJ at Island
This keynote investigates the transition of AI platforms into the browser space, outlining strategies for flexible adoption, robust DLP, and secure agentic workflows.
– Analysing the rapid evolution from standalone chatbots to AI-centric browsers and the implications for enterprise architecture.
– Operationalising a ‘Choose-your-own-AI’ model that aligns specific tools to departmental needs under a unified security umbrella.
– Leveraging AI-native DLP to detect and prevent sophisticated data loss scenarios within the browser environment in real time.
– Designing a governance framework for Agentic AI to ensure autonomous agents operate within strict data sovereignty boundaries.
Morning Break
Refreshments, Snacks & Connections
Edge Panel: Operational Resilience & Securing Autonomous Systems
Sam Fariborz - CISO at David Jones Andre Bertrand - CISO at Transurban Darren Kane - Chief Security Officer at NBN Mark Alexander - CISO at ASD Peter Hind - Principal Research Analyst at ADAPT
This panel challenges security leaders to reconcile the need for unwavering operational uptime with the governance complexities of an AI-driven, consolidated vendor landscape.
– With adversary breakout times under an hour, is your resilience model built to survive inevitable compromise or just hoping to prevent it?
– How must OT security evolve when an operational outage is no longer a simple IT event but a systemic business risk?
– If AI is the top investment priority yet readiness remains low, what specific governance controls are missing from current strategies?
– Who owns the liability for opaque third-party AI decisions, and must supplier assurance now extend to model training and design?
– Does vendor consolidation streamline defence, or create single points of failure beholden to shareholders rather than your threat landscape?
Secure the AI Future, Now
with CyeraThe Cyera team reveals the mindset shift forward-looking enterprises are making to thrive in the AI era.
– Why it is no longer enough for leaders to simply lock information down given that AI runs on data.
– Scaling AI responsibly without treating protection and progress as opposing forces.
– Understanding why only 14% of security leaders currently report success in unifying protection and progress.
Building Cloud Security Programs That Can Shift Left
with WizFor organisations born in the cloud or seeking to adopt modern technologies like containers, Kubernetes, and Serverless architectures, shifting security left is foundational. It empowers engineering teams to collaborate effectively with security teams, and effectively prevent common risks associated with the cloud. But how can this be achieved when security and engineering teams often have transactional relationships? Join this session for real-world examples of how Australian organisations are bringing DevSecOps together with practical guidance from Australian Security leaders.
ADAPT Executive Insight Roundtables - Share with Confidence Under the Chatham House Rule
Attend your preselected roundtable to participate in a peer discussion moderated by ADAPT analysts with subject matter experts.
Make Your Business a Hard Target for Cybercriminals
with ThreatlockerWhen it comes to potential targets for cyberattacks, easier to breach means more likely to fall victim. While you might not be able to influence your perceived value, there are changes that can eliminate your organisation from being seen as an easy target. We’ll explore practical tactics to reduce your surface area of attack and controls to prevent lateral movement should a breach occur.
– Reducing your attack surface by tightly controlling what software, scripts and tools are allowed to run.
– Limiting lateral movement inside the network through strong segmentation, access boundaries and just‑enough privilege.
– Strengthening day‑to‑day operations with continuous hardening: regular policy reviews, targeted monitoring and rapid containment playbooks.
Challenging your Beliefs: How Foundational Controls Significantly Reduce Risk
with Airlock DigitalAs AI-driven threats and ransomware accelerate, many organisations are discovering that faster detection doesn’t always translate to lower risk. Security frameworks like CIS and NIST are increasingly reinforcing a shift toward foundational, preventative controls like Application Allowlisting as a necessary complement to modern detection. This session challenges the belief that allowlisting is operationally difficult. Expect real-world insight, framework context, and a forward-looking view of what “good” looks like over the next few years.
Breaking the Silos: Consolidating Signals to Take Action and Reduce Risk
with Tenable SolutionsThe role of the CISO has fundamentally shifted. You are no longer just managing ‘security debt’; you are managing systemic business risk. While security teams struggle with manual processes, adversaries are leveraging AI to launch attacks at machine speed, exploiting a landscape where the explosion of non-human and human identities has rendered traditional perimeters obsolete. Fragmented point solutions, which offer only a siloed view of vulnerabilities, can no longer keep up with this velocity.
In this session we will explore the challenges faced in today’s complex landscape which now includes AI, countless alert signals from different tooling, prioritising efforts to minimise business risk, whilst managing communications to stakeholders and executives.
The End of Manual Trust: How Automation, Quantum Readiness, and AI Integrity Will Redefine Digital Security This Year
with DigicertAs machine identities surge, certificate lifecycles shrink, and quantum computing threatens today’s cryptographic foundations, Australian organizations are rethinking how intelligent trust is established, managed, and future-proofed. With traditional algorithms facing deprecation and automation becoming essential rather than optional, security leaders are at an inflection point.
Be part of the discussion and answer questions such as:
– What does “manual trust” look like in today’s enterprise? Is it sustainable in practice?
– How are leading ANZ organizations prioritizing automation in certificate lifecycle and crypto asset management?
– What practical steps are security leaders taking now to prepare for post-quantum cryptography? And where is the overlap with general security best practice?
– How can crypto-agility be embedded as a design principle rather than a retrofit?
– With AI systems becoming trust intermediaries, how do we ensure integrity at scale?
We look forward to hearing your point of view.
Peer Networking Seated Lunch
Lunch Roundtable
ADAPT Executive Insight Roundtables - share with confidence under the Chatham House Rule
Attend your preselected roundtable to participate in a peer discussion moderated by ADAPT analysts with subject matter experts.
Securing Agentic AI Before It Rewrites Risk
with AccentureAs agents reshape workflows and infrastructure, CISOs must redesign identity, governance and controls before autonomy expands faster than assurance.
Discussion points
– Where does agent autonomy break existing control, audit and accountability models?
– Which identities, permissions and approvals should every high-risk agent require?
– How do you build an agent cockpit and kill switch?
– What data boundaries stop agents exposing regulated or sensitive information?
– Which teams must redesign workflows when agents act, decide and escalate?
Automated Compliance as a Catalyst for Cyber Maturity and Value
ADAPT’s 2025 surveys of security leaders, show governance and compliance emerging as the top priority.
At the same time, many responses showed CISO are spending more time complying than securing, with limited time, resources, and talent ranking as the three biggest barriers to delivering their core business outcomes.
With regulatory expectations rising and AI driven threats accelerating, the C suite must now rethink compliance — not as overhead, but as a strategic enabler. Automated, continuous compliance has the potential to free CISOs from administrative drag, improve security outcomes, and elevate cyber’s relevance to business value.
Discussion themes:
– Moving beyond manual compliance
How automation can reduce administrative load, improve accuracy, and return time to security uplift.
– Consolidation and simplification as strategic levers
Where automated compliance platforms can streamline tooling, reduce legacy drag, and strengthen posture.
– Cyber risk, cost efficiency, and C suite expectations
How to frame automated compliance and continuous assurance as business value, not just cost.
– Funding tomorrow’s cybersecurity needs
What a forward looking investment strategy looks like in an era defined by gen AI, cloud expansion, and intensifying regulatory scrutiny.
Afternoon Break
Refreshments + Snacks served in lobby from 15:15.
Inside a Breach: Raw Lessons from the Frontlines with Alex Loizou
Alex Loizou - Cybersecurity Leader at Intrinsic Security
Every CISO has a playbook, but few have had to use the whole thing. Alex Loizou joined Medibank in early 2022, leading the security function through one of the most significant and public cyber incidents in Australian history. In this opening keynote, Alex moves beyond the technical post-mortem to share the raw, practical lessons learned from the centre of the storm.
This is an honest discussion about the realities of managing a major breach focussing on the challenges of supporting your organisation, your board, and your team when the playbooks run out of pages. Alex shares his perspective on the structural and personal shifts required to navigate a crisis and, more importantly, how to lead through the aftermath.
Alex Loizou is a seasoned cybersecurity leader with a proven track record of building and leading high-performing security teams. He has extensive experience as a Chief Information Security Officer (CISO) for major organisations such as Medibank, Flybuys, and Bupa. Notably, he served as the CISO at Medibank during their 2022 cyber incident, where he played a crucial role in leading the response and recovery efforts. Since departing Medibank in January 2025, Alex has founded Intrinsic Security, a boutique cybersecurity consultancy with the goal of improving security practices in Australian companies.
Global CISO Guest: Where Are We on the AI SOC Journey?
William MacMillan - Former CISO of the CIA | Former SVP for Info Sec at Salesforce Matt Boon - Senior Research Director at ADAPT
Returning to the Security Edge stage, former CIA CISO William MacMillan unpacks the true progress of AI in the SOC. While adversaries weaponise AI to outpace the 48-minute breakout window, the industry’s obsession with a fully autonomous, “humanless” SOC remains a dangerous illusion. MacMillan dissects what security leaders cannot afford to miss in AI-augmented workflows, and why the unpredictable nature of these models prevents us from handing over the keys to cyber defence without strict evidentiary guardrails.
– How has the AI SOC evolved from early hype to enterprise reality?
– Why the autonomous, humanless SOC remains an unfulfilled and dangerous industry promise.
– Deploying non-deterministic AI safely without hiding risks or making fatal operational decisions.
– Building evidentiary guardrails to safely outpace unrestrained adversaries through human-AI collaboration.
Closing Comments
Security Edge Peer Networking Drinks
An opportunity to stay, mingle and meet other attendees over drinks and food and discuss the day.