Agenda

The EU’s NIS2 Directive represents a step change in Europe’s approach to cybersecurity governance - broadening sectoral scope, tightening reporting timelines, and introducing personal accountability for management. But as compliance deadlines approach, organisations are finding that tick-box exercises won’t cut it. The real opportunity lies in embedding NIS2 principles into a culture of proactive, risk-based resilience - one that integrates cyber governance into enterprise-wide decision-making, supply-chain risk management, and business continuity planning.

This session examines how regulated entities across sectors are interpreting NIS2, from defining “essential and important” services to managing third-party dependencies and achieving alignment with ISO 27001, DORA, and other frameworks. Panellists will discuss how to translate obligations into operational strength, turning regulatory pressure into a catalyst for better oversight, faster incident response, and stronger collaboration between compliance, IT, and the boardroom.

Moderator

• Daniel Tor, Senior Compliance & Assurance Manager (Telecoms GRC), Sky

Panelist

• Nish Imthiyaz, Global Legal Counsel – Privacy, AI, and Digital Regulations, Vodafone
• Simon Laurette, Associate Director - Cyber Regulatory Lead, Forvis Mazars
• Chloe Dellow, Strategic Risk Specialist, OneTrust

Boards increasingly demand cyber fluency. Here’s how CISOs and risk leaders can align their priorities and language.

Moderator

• Eric Alter, Senior Vice President – Cyber/AI Engagement Leader, Marsh Corporate & Commercial

Panelist

• Federico Iaschi, Information Security Director, Starling Bank (TBC)
• Helen Nuttall, UK Cyber Incident Management Leader, Marsh
• Niall McElroy, Consulting Director, Cydea

Reflections from Software Development on Aligning Governance and Risk Management with Agility and Pace AI has transformed the speed and scale of software development — models ship faster and automation accelerates delivery. But governance and risk management haven’t evolved at the same pace. This session takes a bottom-up view from the world of software engineering to explore how governance can become as adaptive, iterative, and data-driven as the systems it seeks to control. Drawing on lessons from agile development, DevSecOps, and AI lifecycle management, we’ll discuss practical ways to embed governance and risk management in flow, not friction — enabling organizations to manage risks, while staying competitive in an AI-driven world.

Speakers

• Emelie Alftrén, Founder, Nooga
• Magnus Juvas, Founder, Nooga

The RegTech market has exploded in recent years, promising to transform how organisations manage compliance, risk, and reporting. Yet not every solution delivers on its hype. This session brings together financial institutions, regulators, and technology innovators to separate substance from spin. Where are RegTech tools truly improving oversight, efficiency, and resilience—and where are they adding complexity or cost? Panellists will explore adoption trends, integration challenges, and lessons from real-world deployments to identify what’s genuinely driving value in the next generation of regulatory technology.

Where are RegTech tools truly improving oversight, efficiency, and resilience—and where are they adding complexity or cost? Panellists will explore adoption trends, integration challenges, and lessons from real-world deployments to identify what’s genuinely driving value in the next generation of regulatory technology.

Moderator

• TBA

Panelist

• Fiona Davies, Ambassador, The RegTech Association
• Lauren de Thibault, RISK Director, BT Group
• Paul Cadwallader, GRC Strategy Director, Corestream GRC

With $10.5 trillion projected to be lost to cybercrime in 2025, and 69% of European teens having committed a cybercrime/cyber misdemeanor, we’re facing a generational crisis.

The Hacking Games seeks to inspire, educate, and empower young people to become defenders rather than attackers. This session discusses the societal, technological, and law enforcement challenges surrounding youth cybercrime and what we can do to address them.

Speaker

• Fergus Hay, CEO, The Hacking Games

M&S, Co-op, JLR and many other hacks this year are being blamed not on foreign cyber crime gangs but English-speaking teenagers. Groups like Lapsus and Scattered Spider have rewritten the rules.

The innocence is gone. Teenage hacking has rapidly evolved from youthful curiosity to a calculated, monetised threat. Whether it's the lure of easy money, the promise of digital celebrity, or targeted recruitment by organised crime, this generation of attackers is skipping the learning phase and going straight to serious criminal activity.

Join Joe Tidy as he uncovers the social and economic drivers behind this dangerous escalation, mapping the common pipeline that converts a gaming enthusiast into a sophisticated, costly cybercriminal.

Speaker

• Joe Tidy, BBC News Cyber Correspondent & Author

What a compliant, well-governed breach response looks like in 2025, from playbooks to post-incident reviews.

Moderator

• Teodora Pimpireva Tapping, Global Head of Privacy, Bumble

Panelist

• Maria Koslunova, Global Privacy and Data Protection Director, Turner & Townsend
• Jack Perrin, Sales Manager, Data Breach, Relativity

Effective cybersecurity isn’t just about IT—it’s about business. This panel examines approaches to integrate risk management into strategic planning, ensuring that cybersecurity efforts directly support organisational goals.

Moderator

• Federico Iaschi, Information Security Director, Starling Bank (TBC)

Panelist

• Priyanka Chatterjee, Chief Executive Officer, London School of Cybersecurity
• Ann McManus, Senior Counsel for Privacy, Data Protection & Cybersecurity | UK DPO, FIS
• Robin Oldham, Founder & CEO, Cydea

"Trust but verify" is no longer just a regulatory mantra, it’s fast becoming a baseline expectation. Compliance frameworks like ISO 27001 or NIST CSF lay the foundations for good security, but paper assurance is not proof. Only by testing your controls under realistic, threat-led conditions can you expose the weaknesses hiding in people, process, and technology. Frameworks such as CBEST, STAR-FS, TIBER (DORA), i-CRT, AASE, and iCAST are now shaping the way cyber resilience is measured – moving the focus from "protect at all costs" to testing an organisation’s ability to detect, respond, and recover. In a world where breaches move at machine speed and AI is weaponised, TLPT is not a luxury; it’s the proving ground for survival.

Speakers

• Ben Turner, SVP, UK&I Cyber Business Director and Head of Consulting & Advisory Services, LRQA
• Anthony Long, Vice President, Strategic Solutions Architect, LRQA

The modern CISO is no longer defined by firewalls or frameworks — but by foresight, resilience, and the ability to translate cyber risk into business strategy. In 2025, the CISO’s value proposition has evolved dramatically. As organisations navigate the demands of NIS2, DORA, and the EU AI Act, the function has shifted from technical gatekeeping to enterprise enablement. The CISO is now an Architect of Digital Trust — a strategic leader balancing innovation with assurance, technology with governance, and agility with resilien

This session marks the unveiling of the CISO Power 100 Index, celebrating the executives shaping the future of European cyber resilience. The Index recognises leadership, influence, and impact — the ability to safeguard not just data, but reputation, operations, and the bottom line. Drawing insights from this year’s honourees, the discussion will examine how CISOs are redefining what success looks like across the organisation’s P&L.

From managing the extended enterprise and governing generative AI to translating risk into financial and operational language that resonates at board level, this fireside conversation will explore what it means to lead in the NIS2/AI era — and what separates the good from the truly great in cyber leadership today.

• DORA, NIS2 & The AI Act: What are the practical, measurable steps C-level leaders are taking to achieve integrated compliance across all three mandates simultaneously.
• The Boardroom Compass: How to translate technical risk into quantifiable financial assurance (P&L protection) and successfully secure resources for strategic resilience programs.
• Enabling GenAI Securely: Debating the most effective, scalable guardrails CISOs are building to allow AI innovation while strictly managing data and liability risk.
• The Extended Perimeter: The critical role of the CISO in managing the volatility of the supply chain and geopolitical shocks that cascade into local operational failure.

Moderator

• TBA

Panelist

• TBA

Speaker

• TBA

In this session, we’ll explore how AI is reshaping the cyber threat landscape, from AI-generated phishing and deepfakes to sophisticated supply chain attacks. We’ll examine why it’s critical to quantify AI-related cyber risks in financial terms, as many organisations still lack effective AI access controls and governance frameworks. Finally, we’ll discuss how assessing resilience now requires detecting AI-driven phishing campaigns and internal misuse of AI tools.

Speaker

• Tim Orchard, Chief Technology Officer, Cydea

SMEs are the backbone of the UK economy — and increasingly, the front line of digital risk. From ransomware and phishing to third-party breaches and GDPR obligations, smaller businesses face the same threats as global corporations but without their resources or dedicated security teams.

This session brings together cyber, legal, and operational experts to explore how SMEs can build resilience without breaking the bank. What are the practical steps for managing data responsibly, training staff, and assessing suppliers when you don’t have an in-house CISO? How can you turn data protection from a compliance burden into a competitive advantage that wins customer trust? And when the worst happens — a breach, a ransomware demand, or a vendor failure — how do you respond swiftly and recover stronger?

Packed with actionable insights, affordable tools, and real-world examples, this panel will help smaller organisations move from reactive defence to proactive resilience — securing not just their data, but their reputation and continuity.

Moderator

• Simon Lascelles, Managing Partner, The Rest is Tech (TBC)

Panelist

• Douglas Clarence, Risk SME - Trading Venues & Control Transformation, Citi (TBC)
• Dr. Japhet Oladipo, Program Manager Security Operations Centre (SOC) Transformation & Security Risk and Compliance (SRC), BAE Systems
• Alex Hollis, Chief Customer Officer, Surecloud

DORA places huge emphasis on ICT third-party risk. This session would focus on practical strategies for moving beyond static assessments to a model of continuous monitoring and assurance of key vendors.

Moderator

• Adrian Jolly, Managing Director, AJC

Panelists

• Samuele Erbì, Head of Third Party Management & Procurement, Wise
• Adam Holland, Strategic Risk Specialist, OneTrust

AI promises to revolutionise diagnostics, treatment, and patient care — but in healthcare, every algorithm runs on highly sensitive personal data. Striking the balance between innovation and compliance has never been more complex. As hospitals and life sciences organisations integrate machine learning into everything from patient triage to drug discovery, they face an increasingly fine line between legitimate data use and regulatory overreach.

This session brings together compliance officers, CIOs, clinicians, and data protection experts to unpack what GDPR really means in the age of AI-driven medicine. How can organisations ensure lawful processing while maintaining the agility needed to innovate? What are the red lines when it comes to consent, data minimisation, and secondary use of health data? And how can leaders maintain patient trust while deploying technologies that even regulators are still learning to interpret? Expect practical insights, real-world case studies, and a clear view of how to embed compliance into clinical innovation — not slow it down.

Moderator

• Dimitrios Kalogeropoulos, CEO, Global Health & Digital Innovation Foundation

Panelist

• Ele Harwich, Senior Director, Newmarket Strategy
• Nahida Rahman, Senior Information Governance Manager - Systems, East London NHS Foundation Trust
• Nathan Lea, Information Governance Lead, The European Institute For Innovation Through Health Data

A candid conversation between insurer, broker, lawyer and risk manager on what ‘best practice’ really looks like for 2026.

Insurance is changing. Risk is changing. Expectations are changing. So how should organisations adapt?

Join a rare, open discussion bringing together every part of the insurance ecosystem - we’ll explore how organisations can move beyond transactional insurance buying and instead build genuine risk partnerships — the kind that lead to better outcomes, more stable premiums, and stronger resilience.

If you're involved in insurance placement, claims, safety, risk, or operations leadership, this will give you a clearer view of what good will look like in 2026.

Moderator

• Christian Harris, Founder, Slip Safety Services

Panelist

• Dave Hall, Industry Practice Manager, AXA XL
• Chris Purcell, Senior Risk Consultant, Marsh
• Leanne Conisbee, Partner, Harrison Clark Rickerbys Ltd
• Ben Cooney, Director, Insurance & Risk Management, Avison Young UK

Under Donald Trump’s revived tariff playbook, Europe’s exporters face not just a squeeze - but a full-scale assault on sectors that have powered jobs, growth and technological leadership. From Germany’s beloved auto hubs to Ireland’s booming pharma pipelines, no trade-heavy economy is immune. This session will cut past the headlines to expose how unpredictable protectionism and escalating trade wars are reshaping supply chains, destabilising investment, and forcing governments to choose between retaliation and resilience.

We’ll bring together economists, industry leaders, and legal experts to map the economic and geopolitical risks: which industries are on the edge? What tools does the UK and EU truly have to respond without sparking runaway escalation? And how much of Europe’s future depends on getting ahead of Trump’s next tariff wave, rather than reacting to the last one?

Moderator

• TBA

Panelist

• Allie Renison, Director and Former UK Government Business and Trade Policy Advisor, SEC Newgate UK (TBC)
• David Henig, Director, UK Trade Policy, European Centre for International Political Economy

When one of the UK’s largest outsourcing firms suffers a breach affecting over six million people, it sends a shockwave far beyond its own systems. The £14m fine handed to Capita is more than a headline — it’s a case study in what happens when governance, accountability, and third-party oversight collapse at scale. From pension data to public records, the incident exposed deep cracks in how organisations manage their data processors and assess security assurance across sprawling vendor networks.

This panel dissects the Capita breach as a cautionary tale for boards, regulators, and risk leaders alike. We’ll explore how systemic vendor dependencies amplify exposure, how governance frameworks failed to translate into operational reality, and what the ICO’s decision signals for corporate accountability going forward. Panellists will also debate whether public-sector outsourcing is now a structural cyber risk — and how regulators, procurement teams, and suppliers can rebuild trust through transparency, continuous monitoring, and shared responsibility.

Moderator

• TBA

Panelist

• Arcangelo Leone de Castris, AI Governance Manager, The Alan Turing Institute
• Victoria Brasier, Director of Information Governance and Management, Sky