Melbourne Cyber in FSI Summit 2027

Beat the rush and join us early for complimentary barista-made coffee and breakfast.

As Australia's banking, superannuation, and insurance sectors manage the nation's most valuable and sensitive pools of capital and data, they've become the most consistently targeted industry in the country's threat landscape. This keynote looks at the scale of what's at stake and what it demands of security leaders.

• Understanding what makes the Financial Services sector uniquely attractive to attackers, from systemic economic impact to the sheer concentration of personal and financial data.
• How AI-accelerated attacks are outpacing security architectures built for a slower-moving threat environment, particularly across institutions carrying significant legacy infrastructure.
• What does genuine resilience look like under APRA's CPS 230 and CPS 234 expectations, and how do leaders balance regulatory compliance with the reality of an accelerating threat environment?

As fraudsters increasingly use AI to generate convincing deepfakes, synthetic identities, and automated social engineering at scale, financial institutions are locked in an accelerating arms race. This keynote examines how fraud and cyber teams are adapting their defences to match the sophistication of AI-enabled financial crime.

• How AI-generated voice, video, and identity documents are being used to bypass verification processes that weren't designed to detect synthetic media.
• The tension between deploying increasingly sophisticated AI-driven fraud detection and maintaining the auditability and explainability regulators and customers expect.
• Why identity verification processes built for a pre-AI threat environment need fundamental redesign, not incremental patching.

As director and officer accountability for cybersecurity outcomes intensifies under CPS 234 and broader governance expectations, this panel examines how CISOs and boards are actually working together, and where the relationship between technical risk owners and governance bodies still needs to mature.

• What's actually working in cybersecurity reporting that gives directors genuine ability to exercise informed oversight.
• How the role is shifting as personal accountability expectations rise, and whether CISOs are being given commensurate authority and resourcing to match that accountability.
• Lessons on embedding cybersecurity into the same rigorous governance and reporting discipline institutions already apply to credit and market risk.

Carrying decades-old core banking infrastructure too critical and costly to replace outright, one security leader built a layered protection strategy that meaningfully reduced legacy system risk exposure while a longer modernisation program continued in parallel.

• Why the team abandoned an unrealistic "replace everything fast" ambition in favour of a phased approach that acknowledged genuine business constraints.
• How network segmentation, enhanced monitoring, and strict access boundaries around legacy systems delivered durable risk reduction in the interim.
• How the team secured sustained funding for protecting systems slated for eventual retirement, when institutional appetite naturally favoured funding the new platform instead.

A hands-on, interactive session working through a real financial services cybersecurity scenario as a room. Details announced soon.

Facing a board frustrated by cybersecurity reports full of technical jargon and unclear risk implications, one CISO redesigned board reporting to translate technical exposure into decisions directors could genuinely own and act on.

• How the team identified that technical completeness was actually obscuring the risk picture rather than clarifying it for a non-technical board.
• The specific changes made to translate vulnerability counts and threat intelligence into potential business impact and financial exposure.
• How reporting frequency and format were redesigned so the board could track risk trends over time, not just react to point-in-time snapshots.

With operational risk increasingly concentrated in a sprawling, poorly tracked network of technology vendors and service providers, one institution built a consolidated third-party risk view that satisfied both CPS 230 obligations and genuine operational need.

• How the team uncovered far more third-party dependencies than existing records showed, and why that gap itself was the first risk finding.
• Building a risk-based approach that focused monitoring effort on vendors whose failure would genuinely disrupt critical operations.
• How the team moved from point-in-time vendor assessments to continuous monitoring that could flag emerging risk between review cycles.

With APRA's CPS 230 operational risk standard now fully in force, this panel brings together risk and resilience leaders from banking, superannuation, and insurance to share what genuine implementation has looked like in practice; beyond the compliance documentation.

• Common blind spots surfaced once organisations moved from documenting resilience to actually testing it under CPS 230's requirements.
• How leading institutions are keeping their understanding of critical operations current as systems, vendors, and dependencies constantly change.
• How risk leaders are managing the tension between meeting APRA's expectations on schedule and building resilience that will actually hold up in a real incident.

Small-group, discussion-based sessions where you'll work through real financial services cybersecurity challenges with peers in similar roles. Roundtable topics will be announced soon.

Put your knowledge to the test in this fast-paced quiz covering real-world trivia, key concepts, and emerging trends. Compete for bragging rights — and a voucher — as the top scorer takes the crown.

After a near-miss involving a convincing deepfake voice call attempting to authorise a large funds transfer, one financial crime leader built a detection and verification framework specifically designed to catch AI-generated fraud attempts before they succeeded.

• How the team used a caught attempt as the catalyst for systemic change, rather than treating it as a one-off close call.
• Designing additional verification steps for high-risk transaction types without slowing down the vast majority of legitimate customer interactions.
• How human judgement and escalation protocols were rebuilt alongside the technical detection layer.

As boards face growing personal and institutional accountability for cybersecurity outcomes under APRA's CPS 234 and broader director duties, this keynote explores what regulators and courts are actually expecting when they assess whether an institution took "reasonable steps" to protect its systems and data.

• Drawing on recent regulatory actions and enforcement guidance to clarify what evidence institutions need to demonstrate adequate cybersecurity governance.
• How CISOs and risk leaders are building reporting that gives boards genuine ability to exercise oversight, rather than simply satisfying a compliance reporting obligation.
• How growing individual liability for directors and officers is changing the seriousness and rigour with which cybersecurity risk is discussed in the boardroom.

As Australian financial institutions rely on growing networks of cloud providers, fintech partners, and outsourced technology vendors, this session explores how security and risk leaders are managing exposure to failures and breaches originating outside their direct control.

• How institutions are building continuous visibility into third-party risk rather than relying on annual questionnaires that go stale within months.
• Lessons on managing incident response, customer communication, and APRA notification when the root cause sits with a service provider, not the institution itself.
• What happens to institutional resilience when multiple financial services organisations depend on the same small set of critical cloud or technology providers.

Unwind with your peers for a couple of drinks on us!

Beat the rush and join us early for complimentary barista-made coffee and breakfast.

As Australia's banking, superannuation, and insurance sectors manage the nation's most valuable and sensitive pools of capital and data, they've become the most consistently targeted industry in the country's threat landscape. This keynote looks at the scale of what's at stake and what it demands of security leaders.

• Understanding what makes the Financial Services sector uniquely attractive to attackers, from systemic economic impact to the sheer concentration of personal and financial data.
• How AI-accelerated attacks are outpacing security architectures built for a slower-moving threat environment, particularly across institutions carrying significant legacy infrastructure.
• What does genuine resilience look like under APRA's CPS 230 and CPS 234 expectations, and how do leaders balance regulatory compliance with the reality of an accelerating threat environment?

As fraudsters increasingly use AI to generate convincing deepfakes, synthetic identities, and automated social engineering at scale, financial institutions are locked in an accelerating arms race. This keynote examines how fraud and cyber teams are adapting their defences to match the sophistication of AI-enabled financial crime.

• How AI-generated voice, video, and identity documents are being used to bypass verification processes that weren't designed to detect synthetic media.
• The tension between deploying increasingly sophisticated AI-driven fraud detection and maintaining the auditability and explainability regulators and customers expect.
• Why identity verification processes built for a pre-AI threat environment need fundamental redesign, not incremental patching.

As director and officer accountability for cybersecurity outcomes intensifies under CPS 234 and broader governance expectations, this panel examines how CISOs and boards are actually working together, and where the relationship between technical risk owners and governance bodies still needs to mature.

• What's actually working in cybersecurity reporting that gives directors genuine ability to exercise informed oversight.
• How the role is shifting as personal accountability expectations rise, and whether CISOs are being given commensurate authority and resourcing to match that accountability.
• Lessons on embedding cybersecurity into the same rigorous governance and reporting discipline institutions already apply to credit and market risk.

Carrying decades-old core banking infrastructure too critical and costly to replace outright, one security leader built a layered protection strategy that meaningfully reduced legacy system risk exposure while a longer modernisation program continued in parallel.

• Why the team abandoned an unrealistic "replace everything fast" ambition in favour of a phased approach that acknowledged genuine business constraints.
• How network segmentation, enhanced monitoring, and strict access boundaries around legacy systems delivered durable risk reduction in the interim.
• How the team secured sustained funding for protecting systems slated for eventual retirement, when institutional appetite naturally favoured funding the new platform instead.

A hands-on, interactive session working through a real financial services cybersecurity scenario as a room. Details announced soon.

Facing a board frustrated by cybersecurity reports full of technical jargon and unclear risk implications, one CISO redesigned board reporting to translate technical exposure into decisions directors could genuinely own and act on.

• How the team identified that technical completeness was actually obscuring the risk picture rather than clarifying it for a non-technical board.
• The specific changes made to translate vulnerability counts and threat intelligence into potential business impact and financial exposure.
• How reporting frequency and format were redesigned so the board could track risk trends over time, not just react to point-in-time snapshots.

With operational risk increasingly concentrated in a sprawling, poorly tracked network of technology vendors and service providers, one institution built a consolidated third-party risk view that satisfied both CPS 230 obligations and genuine operational need.

• How the team uncovered far more third-party dependencies than existing records showed, and why that gap itself was the first risk finding.
• Building a risk-based approach that focused monitoring effort on vendors whose failure would genuinely disrupt critical operations.
• How the team moved from point-in-time vendor assessments to continuous monitoring that could flag emerging risk between review cycles.

With APRA's CPS 230 operational risk standard now fully in force, this panel brings together risk and resilience leaders from banking, superannuation, and insurance to share what genuine implementation has looked like in practice; beyond the compliance documentation.

• Common blind spots surfaced once organisations moved from documenting resilience to actually testing it under CPS 230's requirements.
• How leading institutions are keeping their understanding of critical operations current as systems, vendors, and dependencies constantly change.
• How risk leaders are managing the tension between meeting APRA's expectations on schedule and building resilience that will actually hold up in a real incident.

Small-group, discussion-based sessions where you'll work through real financial services cybersecurity challenges with peers in similar roles. Roundtable topics will be announced soon.

Put your knowledge to the test in this fast-paced quiz covering real-world trivia, key concepts, and emerging trends. Compete for bragging rights — and a voucher — as the top scorer takes the crown.

After a near-miss involving a convincing deepfake voice call attempting to authorise a large funds transfer, one financial crime leader built a detection and verification framework specifically designed to catch AI-generated fraud attempts before they succeeded.

• How the team used a caught attempt as the catalyst for systemic change, rather than treating it as a one-off close call.
• Designing additional verification steps for high-risk transaction types without slowing down the vast majority of legitimate customer interactions.
• How human judgement and escalation protocols were rebuilt alongside the technical detection layer.

As boards face growing personal and institutional accountability for cybersecurity outcomes under APRA's CPS 234 and broader director duties, this keynote explores what regulators and courts are actually expecting when they assess whether an institution took "reasonable steps" to protect its systems and data.

• Drawing on recent regulatory actions and enforcement guidance to clarify what evidence institutions need to demonstrate adequate cybersecurity governance.
• How CISOs and risk leaders are building reporting that gives boards genuine ability to exercise oversight, rather than simply satisfying a compliance reporting obligation.
• How growing individual liability for directors and officers is changing the seriousness and rigour with which cybersecurity risk is discussed in the boardroom.

As Australian financial institutions rely on growing networks of cloud providers, fintech partners, and outsourced technology vendors, this session explores how security and risk leaders are managing exposure to failures and breaches originating outside their direct control.

• How institutions are building continuous visibility into third-party risk rather than relying on annual questionnaires that go stale within months.
• Lessons on managing incident response, customer communication, and APRA notification when the root cause sits with a service provider, not the institution itself.
• What happens to institutional resilience when multiple financial services organisations depend on the same small set of critical cloud or technology providers.

Unwind with your peers for a couple of drinks on us!