CISO FSI ANZ Online schedule

• Reconciling cyber strategy and business priorities that don't always pull in the same direction
• Defining meaningful risk tolerances and executive accountability
• Security outcomes using metrics that matter to boards
• Turning compliance obligations into sustained risk reduction

• Visibility across the estate: Keeping pace with what's running and where risk sits
• Assurance as an ongoing practice: Moving beyond point-in-time checks
• Shared ground for security, risk and audit: Reducing duplicated effort across teams

Speaker:
Nir Peleg Global Field CISO JFrog

• How AI is reshaping payment fraud, account takeover and financial crime
• Strengthening collaboration between cyber, fraud and finance teams
• Fraud prevention and customer experience don't have to be a trade-off: getting the balance right
• AI-enabled attack techniques are emerging faster than most playbooks — how organisations are responding

For decades, financial institutions have managed open source software risk by accepting it. Legacy applications, strict change control, and the operational risk of touching business-critical systems made a growing CVE backlog the cost of doing business.

That calculation no longer holds. Frontier models can now surface dormant vulnerabilities and chain weaknesses across the open source software supply chain faster than traditional security processes can investigate and patch them, while regulators, auditors, and customers demand stronger evidence of software integrity.

Join us to explore how financial institutions can rethink how they govern and adopt open source as risks accelerate. We’ll discuss why reactive vulnerability management is breaking down, and how teams can reduce risk without disrupting business-critical systems, and the practices security and platform leaders can use to establish a more secure, governed approach to open-source consumption.

John will explore:

• Why frontier AI is making previously accepted open source vulnerabilities more urgent
• Why vulnerability exploitation has overtaken phishing as a leading FinServ attack vector
• Best practices for governing open source consumption and vulnerability remediation in regulated environments
• Reducing risk without forcing disruptive upgrades to business-critical applications
• Building stronger software integrity and audit evidence into the software lifecycle

• Not every resilience investment has delivered equal value — what worked and what didn’t
• Recent incidents have changed more than incident response plans — what's shifted in practice?
• How organisations are strengthening readiness for prolonged disruption
• Raising the bar on resilience — what are IT leaders planning?

• Visibility gaps across cloud and SaaS environments are where risk tends to hide
• Configuration and identity risk multiply with every new environment added: rethinking oversight itself, not just adding more tools
• Protecting APIs and third-party integrations — the connective tissue of open banking
• Maintaining compliance across distributed infrastructure in every environment 

Speaker:
Senior Representative Obsidian  

• Embedding AI into existing risk and control frameworks, rather than building a parallel regime
• Translating AI risk appetite into metrics boards can actually act on
• Closing the assurance gap on vendor and embedded AI tools

AI is reshaping how software is built in financial services, but speed without control is a risk that regulators and boards will not accept. Supervisory expectations for AI are converging across jurisdictions, with APRA, MAS and European regulators each setting clear standards for institutions that adopt it. This session examines how those expectations translate into practical requirements for vendor independence, reproducibility, security and context management.

Drawing on conversations with financial services customers, it also shows why the organisations moving fastest are those that retain control, not simply those with the most capable models. Attendees will leave with a clear framework for making AI-assisted engineering both fast and governable.

• Mapping critical dependencies: understanding which suppliers, services and business processes matter most when disruption occurs
• Managing concentration risk when cloud, technology and other critical services depend on a small number of strategic providers
• Outsourcing services, not accountability: where responsibility sits when critical third- and fourth-party services fail
• Beyond the annual review: combining vendor assessments with continuous assurance, control validation and deeper visibility across the ecosystem
• Building resilience across the wider ecosystem: from recovery planning and strategic supplier partnerships to fourth-party, geopolitical and systemic risk

Speakers:

Aaron McKeown CISO NGM Group

Daminda Kumara CISO Commonwealth Superannuation Corporation

Tony Arnold CISO TSB Bank New Zealand

Asanga Wanigatunga Vice President APJ Obsidian

Rucha Gatti Director, Tech & Info Security Risk, Resilience Risk - Group Risk National Australia Bank (moderator) 

In this session, we’ll examine the cryptographic foundations that support critical business operations across the financial services sector and why they are becoming a strategic resilience concern. From data protection and digital trust to third-party dependencies and emerging quantum risks, we’ll discuss what organisations need to understand now to prepare for the transition to post-quantum cryptography (PQC). Drawing on APRA CPS230/234 and ASD's approach to PQC, we’ll present a practical 2027 watchlist for turning PQC awareness into measurable action.

Key takeaways:

• Identify what needs protection first: Prioritise financial and AI data with long confidentiality requirements
• Know what could delay migration: Map cryptographic assets, ownership and third-party dependencies
• Start a measurable readiness plan and start building crypto agility: Establish a focused 90-day programme covering discovery, controlled pilots, interoperability and operational recovery, while considering current BFSI regulations & frameworks
• The countdown is about your preparation time, not a predicted date for quantum disruption

• Turning the day's governance, AI and resilience frameworks into behaviours that stick across a workforce, not just the security team
• Building an "always-on" security culture instead of annual training and phishing tests
• Communicating cyber risk in language the business and customer trust