Latest 2026 Programme
New sessions and speakers updated regularly. Check back for the latest
Thursday, November 26
Forget presentations and prepared statements. This is your opportunity to put your toughest questions directly to the UK’s leading cyber and data regulators. With no slides, no speeches and no pre-approved agenda, this candid “Ask Me Anything” session gives CIOs and CISOs unprecedented access to the organisations shaping the UK’s cyber, data protection and operational resilience landscape.
Questions to explore:
– What are regulators seeing that organisations are still getting wrong?
– What does “good” cyber governance really look like in 2026?
– How will AI change regulatory expectations over the next three years?
– Which emerging risks are keeping regulators awake at night?
– How can organisations build stronger relationships with regulators before an incident occurs?
– If you could give every FTSE 100 board one piece of advice, what would it be?
– What do organisations consistently overestimate – or underestimate – about regulatory scrutiny?
Bringing together representatives from regulatory bodies for an “Ask Me Anything” session. No presentations- only audience questions.
Human cyber risk is evolving faster than CISO’s can train their teams to keep up. AI-powered social engineering, shadow AI and everyday risky behaviours are creating new forms of exposure across the organisation. For security leaders, training completion alone doesn’t tell you much about actual risk. The bigger question is where exposure sits, which behaviours matter most, and how much of that risk can be reduced before an employee even needs to act. At Riot, we believe the opportunity is to connect both sides: automate what can be handled in the background, involve employees when it matters, and adapt protection based on the level of risk. As threats accelerate, security must also become more proactive and automated, using behavioural signals, automation and AI to identify exposure early and reduce risk before it turns into an incident.
Discover:
–How organisations can move beyond awareness and compliance towards a more proactive, measurable approach to employee security posture management
–What security leaders should actually measure to understand and prioritise human cyber risk
–Where automation and AI can reduce risk before human intervention is needed and where employee behaviour and engagement still matter most
Cybersecurity leadership is no longer simply about managing risk, technology and controls. It is about earning board confidence, enabling business strategy and making the right decisions when security, growth, operational resilience and commercial priorities collide.
Drawing on lessons from The Digital Leader’s Playbook and more than 25 years leading technology at organisations including British Airways, John Lewis Partnership, Johnson Matthey and Persimmon, Paul Coby will explore the leadership principles that matter most to today’s CISO and CSO.
Through the lens of his 60 maxims for technology leadership, Paul will examine how security and digital leaders can strengthen their influence together at board level, build trusted relationships with business leaders, make better investment decisions and embed cybersecurity into transformation rather than treating it as a barrier to progress.
For CISOs and CSOs operating under growing regulatory, commercial and operational pressure, this is an opportunity to take proven lessons from the CIO’s playbook and apply them to the realities of leading cybersecurity at scale.
The world’s leading cybersecurity providers face the same evolving threats as every other organisation – but with the added pressure of setting the standard for the industry. In this fast-paced executive session, senior security leaders share how they’re transforming their own security operations, responding to emerging threats and deciding where to invest next. Expect honest insights into what’s working, what isn’t, and the technologies and strategies shaping the future of cyber defence.
Hear first-hand:
– How we’ve implemented new security technologies across our own organisations
– The biggest cyber challenges we’re facing – and how they’re evolving
– How AI is reshaping our security operations, governance and decision-making
– Emerging threats we’re preparing for over the next 12–24 months
– Technologies and capabilities we’re prioritising – and those we’re moving away from
– How we’re balancing innovation, resilience and operational complexity
– Lessons learned from transformation programmes and major security initiatives
– One prediction every CIO and CISO should be planning for today
Every CISO faces the same challenge: how do you maximise security outcomes with finite resources? In this rare behind-the-scenes keynote, a FTSE 100 security leader shares how they approach one of the biggest decisions in cybersecurity -where to invest, where to cut, and how to demonstrate value to the board. Gain an honest insight into the trade-offs, tough conversations and investment decisions that shape a modern enterprise security strategy, as one security leader walks through how they allocate a large security budget.
– The biggest investment priorities for today’s enterprise security function
– Where we’re increasing spend – and where we’re confidently reducing it
– Lessons learned from security investments that didn’t deliver the expected value
– Rationalising vendors without increasing organisational risk
– Balancing innovation, resilience, compliance and business priorities
– How to build a compelling business case for security investment
– The metrics and KPIs that matter most to boards and executive committees
– Looking ahead: where should security leaders be investing over the next three years?
– If I had to cut 20% of my security budget tomorrow, what would I stop funding – and what would I protect at all costs?
By now, most of us have read the incident reports: OpenAI and Hugging Face, AISI’s testing of Anthropic’s model, Anthropic’s own retrospective, Meta’s. This session isn’t another walkthrough of what happened, the focus is what it means for the cybersecurity team. We’ll skip the recap and go straight to the “so what”: the four threat scenarios these incidents actually establish, why an agent inside your network is not the same threat as a human, where your team has transferable cybersecurity skills, and where it probably doesn’t. Finally the session will propose some answers to the questions CISOs are asking: what skills should we be developing, training, and hiring for?
As AI agents take on more autonomous work across the enterprise, security and privacy leaders face a new set of risks, and a shrinking window to get ahead of them. In this session, Matthew O’Neill explores how leading organisations are rethinking their approach to data protection, governance, and operational resilience for the agentic era. Drawing on real-world strategies, he’ll share how CISOs and security leaders can move from reactive defence to proactive trust, building the foundations needed to innovate safely at speed.
Building on the keynote’s exploration of the human layer of enterprise risk, this private lunch brings together a select group of CISOs for a candid, peer-led discussion on turning insight into action. With AI-powered social engineering, shadow AI and everyday employee behaviours creating new forms of exposure, the challenge is knowing where to focus, what to measure and which interventions genuinely make a difference.
Together, participants will compare approaches to prioritising human cyber risk, explore where automation and AI can reduce exposure before employees need to act, and debate how to strengthen security behaviours without adding unnecessary friction across the organisation.
Every security leader has made an investment that promised transformational results but failed to deliver. In this refreshingly candid panel, CISOs share the technologies, programmes and procurement decisions they wish they’d approached differently. Without naming vendors, they’ll unpack the real reasons projects fall short – and reveal the lessons that have shaped how they evaluate, implement and measure security investments today.
– What made the solution look like the right decision at the time?
– At what point did you realise it wasn’t delivering the expected value?
– Were the warning signs there from the beginning -and did you miss them?
– Was the failure down to the technology, implementation, culture or unrealistic expectations?
– How do you distinguish between a poor product and poor change management?
– What questions should every CISO ask before making a major security investment?
– How do you know when to persevere – and when to cut your losses?
– What procurement, governance and stakeholder lessons have fundamentally changed the way you buy technology today?
– If you had to remove one security tool from your stack tomorrow, which would it be – and would anyone notice?
What are your peers really thinking? Before the conference, delegates were invited to anonymously share their views on the biggest issues facing today’s security leaders – from AI governance and board engagement to budgets, ransomware and burnout. In this rapid-fire session, we’ll reveal the results live, challenge expectations and uncover the trends, surprises and uncomfortable truths shaping the future of cyber leadership.
If you had £20 million to transform your organisation’s cyber resilience, where would you invest – and what would you leave behind? In this interactive strategy challenge, you’ll join fellow CIOs and CISOs to tackle the competing priorities every security leader faces today. With finite budgets, evolving threats and increasing board expectations, can your team build a strategy that delivers resilience, innovation and measurable business value?
The Challenge:
Working in table teams, you’ll take on the role of the executive security leadership team for a fictional FTSE 100 organisation. Each table will receive a unique business scenario, complete with its own opportunities, constraints and risks. Each scenario includes:
– A detailed business profile and strategic priorities
– A fixed £20 million cyber investment budget
– The latest threat intelligence and risk landscape
– Organisational skills and resource constraints
– Regulatory and compliance obligations
– Business growth plans, digital transformation initiatives and board expectations
Your mission:
– Decide where to invest- and where not to
– Prioritise the initiatives that will have the greatest business impact
– Balance innovation, resilience, compliance and operational risk
– Prepare a three-year cyber strategy that you can defend to the board
Feedback & Debate:
Each table will have two minutes to present the highlights of its strategy before the room compares approaches. This session will explore why different teams made different investment decisions, challenge assumptions and identify the common priorities emerging across the room.
Questions we’ll explore:
– Where should today’s CISOs be investing most heavily?
– What would you deliberately stop funding?
– How do you justify difficult investment decisions to the board?
– How do you balance cyber resilience with AI, cloud and digital transformation?
– What does a successful three-year security strategy look like in 2026?
Faster Than You: Securing Agentic AI – From Insight to Action
Most of us have seen the incident reports – OpenAI, Hugging Face, AISI’s testing of Anthropic’s model, Anthropic’s own retrospective, Meta and others. This isn’t another session walking through what happened. The real question is: what do these incidents mean for the cybersecurity team?
In this closed-door discussion, we’ll skip the recap and go straight to the “so what?” – exploring the four threat scenarios these incidents are beginning to establish, why an autonomous agent operating inside your network presents a fundamentally different challenge from a human attacker, and which existing cybersecurity skills transfer well – and which may no longer be enough.
The conversation will then turn to the practical questions CISOs are grappling with: What capabilities do we need to build? What should we be training our teams for? And where will we need to hire entirely different skills?
–Have the people on your team who design least privilege, trust and segmentation had any exposure to how an agent actually behaves?
–Do you formally threat-model an agent as an insider, distinct from a human (a user or a threat actor)? Whose job is this? Do they need training, or do you need to hire for it?
–When your team reviews vendor’s security questionnaires, do they have the technical depth to evaluate vendor’s claims about agent isolation?
–Agentic-speed detection and response is a genuinely new skill, not an extension of an old one. Will you grow it inside your current IR team, hire specialists in, or partner with a vendor who already has it?
As organisations race to deploy AI, CIOs want to empower the workforce while CISOs are under pressure to protect sensitive data, intellectual property and critical systems. Does AI demand tighter controls, or is excessive governance the biggest threat to innovation? Senior leaders go head-to-head in a live debate, with the audience voting before and after to decide which argument prevails.
The audience will vote on:
– This House believes AI requires more restrictive security controls
– This House believes AI makes traditional security policies obsolete
– This House believes productivity should trump protection in the age of AI
– This House believes Zero Trust Is no longer fit for the AI era
– This House believes every employee should have unrestricted access to enterprise AI tools
Forget polished presentations and hindsight. In this fast-paced session, five leading CISOs each have just five minutes to share the one issue that caused them the greatest concern in 2026 – whether it was AI, board pressure, resilience, talent, regulation or something no one saw coming. Following the lightning talks, all five speakers return to the stage for an interactive Q&A, giving delegates the opportunity to dig deeper into the challenges, decisions and lessons that defined the year.
Expect honest insights on topics such as:
– The one challenge that had the biggest impact on my organisation this year
– The decision I found most difficult to make
– The emerging risk I underestimated – and won’t again
– What changed my security strategy in 2026
– The biggest lesson I’ve taken into 2027
– One prediction every CIO and CISO should be preparing for now
This isn’t a collection of case studies – it’s a rapid-fire insight into the issues that genuinely occupied the minds of security leaders over the past year. By bringing together five different perspectives, delegates will gain a unique snapshot of the risks, decisions and leadership challenges shaping the UK’s cyber agenda, while discovering whether the concerns keeping one CISO awake are shared across the entire industry.
